A client successfully authenticates to Vault but cannot read a particular secret. What does this demonstrate?

1. The secrets engine is necessarily corrupt
2. Authentication and authorization are separate decisions
3. Successful login should automatically permit every secret read
4. Vault must be sealed whenever a policy denies access