X_FORBIDDEN
Means
policy denied this actor
Typical cause
the actor exists but the policy said no. A remote caller — a production problem document, an app's MCP tool result — is given the error's callerFix instead: ask the account owner or an administrator for the permission (As of 22.10)
Fix
x policy explain <path> --json