Build a useful investigation brief
Pair allowed and denied calls
Create one allowed read, one denied operation, and one request for the wrong resource using synthetic identifiers. Record expected scopes, audience, tenant, and result before sending anything. Keep the token body redacted while retaining the claims needed to explain the decision.
Follow claims into policy
Follow the credential label from configuration through header construction, token decoding, endpoint policy, and response mapping. Compare the exact operation and resource at each boundary. Capture client revision and policy version so a changed local branch is not mistaken for remote behavior.
Vary one permission input
Change only the scope, resource, audience, or environment in separate runs. A successful variation supports a boundary hypothesis but does not justify granting that value everywhere. If two explanations still fit, name the missing policy or token observation instead of declaring a root cause.
What to carry forward
The investigation is ready when paired calls, claims, resource policy, client revision, and response mapping explain the first divergence. Recommend one narrow configuration or evidence change. Leave access unresolved where the authority owner or remote policy cannot be observed from the available fixtures.
Technical background: OpenAI documentation.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow