"Engineers mitigated the problem by temporarily reducing gateway retries through a code change and configuring the load balancers to reject inbound Copilot Token Service requests with HTTP 403 responses."

^^ How can the LB reject a request when it hasn't hit the backend yet to known what the response would be? (eg the 403)