A Gatekeeper upgrade looks healthy and one team still creates forbidden...

The constraint is correct, yet one request path exits earlier in the chain and never reaches the Gatekeeper validation stage under timeout pressure.