Private filesystem does fire 403 on every role and file Like the title might expect I am not able to view any file that i am  delivering through the private file system. Only if I bypass the access check via role settings.
I tested it a minute ago with a fresh d8.9 installation. Here images are are delivered (statuscode: 200). I my main project I receive a 403. Why is that so ?
Drupal does create the private files and as admin (bypassing) I also can see the file. As non admin (authenticated user) I cannot.
How can I debug this issue?
A theory I have read said something about varnish setting... I searched  the whole project without finding any script mentioning &quot;varnish&quot;. I spend now good 6 hours... checked roles, scripts and so on. I could now start a crazy adventure by deinstalling 80+ modules until it might work or somebody could give me a hint how I debug this madness?
Thanks in advance

Guests on the left | authenticated users on the right
If you need to debug access at the Drupal application level, then look at FileDownloadController::download; it's the controller method for the /system/files/{filepath} path; you can use your tool of choice to inspect the execution flow from request to the returned response object.
If the issue is outside the Drupal application level (e.g. web server, varnish) then it will require further stack troubleshooting.