A Bedrock invocation fails with AccessDenied before generation begins. What is the most appropriate investigation?

1. Retry indefinitely with the same denied identity.
2. Check caller identity, model or profile access, and applicable IAM, endpoint, and organization policies.
3. Make the prompt more polite as the only permission change.
4. Increase temperature because authorization depends on model creativity.