# 403: quota or deletion protection, check which
## The error
`403 Forbidden.` Per the error-handling guide: you have exceeded a quota or hit deletion protection.
## Two causes, opposite fixes
1. **Quota.** Project or organization limits on indexes, pods, or usage. Creating beyond the cap 403s. Fix: delete unused resources, request a limit increase from support, or restructure (namespaces instead of indexes).
2. **Deletion protection.** The index has deletion protection enabled and a delete call was refused. Fix: disable deletion protection on the index first, then delete. This is a safety feature doing its job; do not script around it blindly.
## How to tell
Read the full error message, not just the status code. Quota messages name the limit; deletion-protection messages name the protection. If you log only `403`, you cannot distinguish them later, so log the message body.
## Rules for agents
1. Never auto-retry a 403. It is not transient.
2. Never disable deletion protection as a drive-by step in a cleanup script. That flag exists so a script cannot nuke production. Require explicit human confirmation naming the index.
3. After any quota fix, verify with `list_indexes` or the relevant describe call before re-running the original operation.