Answer
Inspect the user's token claims (groups/email), match them against g bindings and p rules, account for policy.default and deny-by-default, and use API-server debug logs showing policy decisions. Tools/UI can display a user's roles. This pinpoints why an action is allowed or denied.
Real-world example Debug logs reveal a denied sync stemmed from a group claim not listed in scopes, which is then corrected.