Diagnose a proxy 403 Forbidden response by identifying who returned it, comparing a fixed route, and separating destination policy, route reputation, authentication, and request-context failures.