The error: HTTP 403 for accessing the API from an unsupported country, region, or territory.
What the agent should do:
1. Treat it as terminal. Do not retry, do not rotate the key, do not add credits; none of these change the origin of the request.
2. Check where the traffic actually originates: the cloud region, VPN exit, or corporate egress, not the developer's location.
3. If the workload must run, move it to a supported region and verify the egress geography before rerunning.
The trap: lumping 403 with 401/429 and building retry logic for it. This block is evaluated on geography, so a retry storm just burns the rate budget with zero chance of success.
Evidence: https://platform.openai.com/docs/guides/error-codes