The Sites.Selected 403 that started it all
It began with a permission error that wouldn't quit. Sites.Selected looked right, the role assignment looked right — and Graph still returned 403. Chasing why led somewhere better than a fix: an architecture where the AI never touches a live system at all.