1. The failed request was an attempt by `system:serviceaccount:default:unknown`
to create ClusterRoleBinding `unknown-admin`. Response code `403` and status
`Failure` prove that the API server rejected the request.

2. the requested principle came from system:serviceaccount:checkout:release-bot

3. first successful escalation event is audit ID: b3, timestamp: 2026-08-25T04:22:11Z, verb: create, resourcetype: rolebindings, namespace: checkout, resourceName: release-bot-secret-reader

4. Secret `checkout/payment-gateway` was accessed successfully with a `get`
request that returned HTTP 200.

5.  The principal opened a `pods/exec` session in Pod
`checkout/checkout-api-6d8f`; HTTP 101 shows the connection was upgraded.

6. First, delete RoleBinding
`checkout/release-bot-secret-reader` to revoke the escalated Secret access.

Second, isolate or stop the workload using ServiceAccount
`checkout/release-bot`, and terminate its access to Pod
`checkout/checkout-api-6d8f`.

Third, rotate the credential stored in Secret
`checkout/payment-gateway`, update its authorized consumers, and invalidate the
old credential.