Why do insert, update, delete, or create-dataset return 403 even with valid RACF credentials?

RACF is necessary but not sufficient. The write surface is off by default. Enable it with ol.dataset-write.enabled or send X-OL-Dataset-Write-Authorized. Read-by-key is not write-gated. Valid RACF plus a closed write surface still returns 403 on insert, update, delete, and create-dataset.