My agent is failing with 'unauthorized tool call' errors in Catalyst—how do I troubleshoot the identity or policy issue?

First, verify the agent’s workload identity is correctly provisioned by checking Catalyst’s identity registry. Then, review the tool authorization policy for that identity—ensure the tool name and action match exactly (MCP tool names are case-sensitive). Check if the policy has a deny rule that inadvertently blocks the call. Use Catalyst’s policy simulation tool to test the call without affecting production. Finally, inspect the audit log for the exact authorization decision.