You're two hours into debugging a production issue. Your API contract says the response should look like this: { "user": { "id": 42, "name": "Alice", "role": "admin", "active": true }, "permissions": ["read", "write", "delete"] } But something downstream is breaking. You log the actual response and squint at it. It looks the same. Roughly. But your authorization middleware just denied an admin