A gateway returns a successful authorization result but the backend function invocation fails with access denied. What should be investigated?

1. The separate gateway-to-backend invocation permission and backend configuration.
2. Give every API consumer tenancy administrator access.
3. Change the endpoint's human-readable description only.
4. Assume client JWT validation authorizes every OCI service action.