Use this playbook to triage policy-based access denials after authentication succeeds, isolate the deny layer, and apply least-privilege remediation safely.
Last reviewed: February 23, 2026|Editorial standard: source-backed operational guidance
401 means authentication credentials are missing or invalid, while 403 means the server understood the request but refuses to fulfill it due to authorization policy.
Another deny layer can still block access, such as explicit deny statements, permissions boundaries, org policies, or resource-level conditions.
Apply minimal scoped permission changes for the exact principal and action, verify with replay, then remove temporary expansions to preserve least privilege.
AWS evaluates explicit deny before allow, so one matching deny statement overrides every allow path. GCP standard IAM triage centers on role bindings, scope, and binding-condition evaluation because it does not use the same explicit-deny-first path in basic binding checks. Azure computes effective access through scope inheritance and role assignments, and deny assignments can block access at higher scopes. These differences change where responders should inspect policy evidence first.