Aglet

Triage a service account API permission gap

One service account can read a health endpoint and still lack the role for a resource operation. Freeze one denial and compare it with an allowed call using the same labeled identity. Record resource, operation, environment, response, and scope without exposing credentials.

Establish what is happening

  1. Capture the denied operation

    Record service identity label, environment, endpoint, resource, method, request time, and response code. Note whether the operation was read, write, or reconciliation. Keep token material out and preserve the expected role beside the actual result.

  2. Compare an allowed call

    Run a harmless operation that should be permitted, then compare tenant, resource class, scope, role, and response mapping. A successful health call proves identity reaches the service; it does not prove resource authority.

  3. Bound permission variants

    Group denials by operation, resource, tenant, environment, identity, and client revision. Separate missing role, wrong identity, tenant mismatch, and endpoint-specific policy. Quarantine any resource whose ownership or tenant cannot be established.

What to carry forward

Triage ends with a denied operation, allowed comparison, role and tenant evidence, affected cohort, and explicit unknowns. Stop before broadening access. Route identity, resource, and role questions separately. Keep the role request narrow and reviewable with evidence for approval.

Technical background: OpenAI documentation.

Keep the decision with the work.

Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.

Create an account See the product workflow