code: func Forbidden(ctx context.Context, attributes authorizer.Attributes, w http.ResponseWriter, req *http.Request, reason string, s runtime.NegotiatedSerializer) {
  	msg := sanitizer.Replace(forbiddenMessage(attributes))
  	w.Header().Set("X-Content-Type-Options", "nosniff")
  
  	var errMsg string
  	if len(reason) == 0 {
  		errMsg = fmt.Sprintf("%s", msg)
  	} else {
  		errMsg = fmt.Sprintf("%s: %s", msg, reason)
  	}
  	gv := schema.GroupVersion{Group: attributes.GetAPIGroup(), Version: attributes.GetAPIVersion()}
  	gr := schema.GroupResource{Group: attributes.GetAPIGroup(), Resource: attributes.GetResource()}
  	ErrorNegotiated(apierrors.NewForbidden(gr, attributes.GetName(), fmt.Errorf(errMsg)), s, gv, w, req)
  }
docs: // Forbidden renders a simple forbidden error