Two applicable policies both match a requested Vault path. One explicitly denies the operation. What is the effect of that deny?

1. The explicit deny takes precedence over other grants
2. The policy with the shortest name automatically wins
3. The token receives root privileges to resolve the conflict
4. An additional read grant always cancels the deny