Establish what is happening
Inspect the denied operation
Save the method, endpoint, environment label, request time, and correlation identifier for one failure. Redact the token and payload. Record the expected operation beside the status and machine-readable error so later reviewers can distinguish authorization from transport or parsing failure.
Compare read and write scopes
Run the same credential against a harmless operation that should be allowed. Compare resource, tenant, audience, and scope evidence with the denied call. A successful health or read request narrows the issue; it does not prove that the write or restricted resource is authorized.
Split permission from identity
Check the requested scope, resource role, and environment against the documented operation contract. Keep a missing scope, expired token, wrong resource, and local policy rejection as separate possibilities. Count failures by operation and credential label, not by status code alone.
What to carry forward
Triage ends when one denial has a reproducible request, a compared allowed operation, a named policy boundary, and an explicit unknown. Stop before widening access. Route the smallest remaining permission question to its owner with the redacted evidence attached.
Technical background: OpenAI documentation.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow