Production 403s at a reverse proxy are usually policy mismatches, not random origin failures. Prefer separating edge auth, IP allow lists, and upstream ACL so a single misaligned Host or path rewrite cannot look like an application bug. Keep the proxy error page distinct from the origin 403 body so on-call can tell which layer rejected the request before opening application logs.

Ops prove-out after tightening proxy rules: hit a canary path that should pass and one that should block, then compare status, response headers, and upstream access logs for the same request id. Watch 403 rate by route and by rule name for one deploy window — a spike on previously healthy paths usually means a shared deny rule grew too wide or a rewrite dropped a required header. Roll under peak and keep a bypass canary with the prior rule set so you can tell a bad ACL from a real upstream outage.