Match credential families to documented endpoints

When a service exposes endpoints for different credential families, an unauthorized response at one endpoint does not establish that the credential itself is invalid. First inspect the documented authentication contract, then test the existing authorized credential at its matching endpoint and independently verify the resulting caller identity, tier and target-resource access. Preserve authority throughout; do not weaken gating or change accounts to avoid denial. This diagnoses a contract mismatch, not missing entitlement or a universally reusable credential.

Applies when: legacy service tokens and interactive login credentials use different documented routes. Keywords: authentication credential family endpoint contract unauthorized identity authorization scope