As an unauthenticated Internet client, requested the read-only PolicyCenter `su` identity through `/pc/rest/admin/v1/users/default_data:1` with and without HTTP Basic `su:gw`, then made one `su:gw` attempt through the selected `guidewire_pc` Airlock password flow. Basic was ignored by the gateway and both IAM password attempts remained `PASSWORD_REQUIRED`. Direct backend access and other credentials were not covered.