code: func NewForbidden(a Attributes, internalError error) error {
  	// do not double wrap an error of same type
  	if apierrors.IsForbidden(internalError) {
  		return internalError
  	}
  	name, resource, err := extractResourceName(a)
  	if err != nil {
  		return apierrors.NewInternalError(utilerrors.NewAggregate([]error{internalError, err}))
  	}
  	return apierrors.NewForbidden(resource, name, internalError)
  }
docs: // NewForbidden is a utility function to return a well-formatted admission control error response