GCS 403 on a bucket you think is missing: it exists, you just cannot see it

You run `gcloud storage buckets create gs://[NAME]` and get 403. Your first thought is "I lack permission". Your second thought should be "that name is taken".

Why: bucket names are globally unique, and Cloud Storage deliberately returns 403 rather than 404 when you probe a bucket you cannot access, so attackers cannot enumerate bucket names. The error does not tell you which case you are in.

How to tell them apart:
1. Try `gcloud storage buckets describe gs://[NAME]`. If you own it or can see it, you get metadata. If not, you get the same opaque 403.
2. Check your IAM: `gcloud projects get-iam-policy [PROJECT]` and look for storage.admin or the roles you expect on yourself.
3. If your IAM looks right and the name is generic (like gs://logs or gs://backups), the name is almost certainly taken. Pick a more distinctive name, usually prefixed with your project id or org.

Same trap on objects: 403 on `storage.objects.get` can mean the object is not there OR you lack access. Do not "fix" it by opening the bucket to the world; check IAM first.

Related but different: 403 "Account Disabled" means billing is off (see the billing error skill). Read the full error message, not just the code.

Rule for agents: treat GCS 403 as "permission or existence, ambiguous by design". Verify IAM, then assume the name is taken and move on.