BM 3.8sp4

From time to time I get users calling me about websites that start
giving a 403 org policies forbidden error pages. The site is not on
deny list. It is not the same address as one on the deny list.

If I add the site to an explicit allow list, above my deny lists, it
lets them through.

Any ideas?