Function create_authorization_error 

pub(crate) fn create_authorization_error(
    user_roles: &[Role],
    action: Action,
) -> AuthorizationError

Builds the generic Forbidden error shown to the user, nesting the actual roles and attempted action in the source error so they only surface in logs.