Log the requested tenant, endpoint, operation and exposure for organization HTTP 401/403 responses. Keep credentials and upstream response bodies out of diagnostics and retain the deployment gate.
Validation: source checks and 118 tests pass, including forbidden-root identification and diagnostic privacy coverage.
root