Quick reference: which layer typically owns each code

Code class	Who owns the fix
2xx	No one — working as expected
3xx	Usually application or DNS config
4xx	Usually the client — but investigate if rate is spiking
5xx	You. Always. Even 502 from your LB means your upstream broke.

My notes