An application needs to read an existing KV v2 secret at secret/data/payments and must not modify it. Which policy capability is appropriate on that data path?

1. update
2. sudo alone
3. delete
4. read