In the Result-Code or Experimental-Result-Code AVP of a Diameter answer (S6a, S6d, Gx, Gy, Cx…).
What to check
Check the subscriber's subscription profile and contracted services.
Look at the Origin-Host of the answer: an intermediate agent (DRA/IPX) and the home HSS mean different owners of the problem.
Got a trace with Diameter 5003 DIAMETER_AUTHORIZATION_REJECTED? Drop it in the analyzer: it finds the step that really failed first, which node sent the code and what to ask the other side. Captures, test-system PDFs and vendor exports. 5 free analyses a month, no sign-up.