---
title: Runbook — ACTUATOR_FORBIDDEN (Actuator 접근 거부)
category: AUTHZ
error_codes: [ACTUATOR_FORBIDDEN]
severity: P2
owner: oncall
last_updated: 2026-06-15
status: stub
---

# Runbook: ACTUATOR_FORBIDDEN (`runbook://management/actuator-forbidden`)

## Symptoms

- HTTP 403 with `error.code=ACTUATOR_FORBIDDEN`
- Attempt to access restricted actuator endpoint (env/configprops/heapdump/shutdown)

## Diagnosis

- Identify which actuator endpoint was accessed
- Check caller identity (internal tooling vs external)

## Action

- Verify management port is not exposed externally
- For heapdump/threaddump: follow break-glass runbook procedure

## Escalation

- P1 if forbidden actuator access appears to be external attack

---

> **Stub**: Phase D2 — author body after domain adoption. (feature-operational-runbook-contract D9)