The activated policy

No bearer token, or the token could not be parsed.

The two do not read identically. A request with no token gets the
envelope below with the message
"Authentication token is missing or invalid.", though its
timestamp carries nanosecond rather than millisecond precision. A
token that is present but unusable (unparseable, or missing sub /
tenant_id) is answered with a default error body that carries a
path rather than a useful message.

No such resource in the caller's tenant. A resource that exists in
another tenant is also reported here.

Another policy already holds this (ruleType, action, templateKey)