A user knows a valid password but has no permission to open payroll records. Which distinction explains the denial?

1. A valid password guarantees all data access
2. Encryption replaces permission checks
3. Authorization always occurs before identity can exist
4. Authentication does not imply authorization