A Vault token has no policy granting access to a requested path. What is the normal authorization result?

1. The operation is denied
2. The operation is allowed after the first denied attempt
3. The operation is allowed if the client knows the path
4. The client inherits the root token's privileges