One SSH key too many
The access team keeps a list of approved SSH keys. Compare it with the authorized_keys files on gw-01 and find the key nobody approved.
Briefing
gw-01 is a jump host. Every key in an authorized_keys file should be on the approved list in /srv/access/approved_keys.txt, which the access team maintains.
You are on a forensic copy of the host as root, so every home directory is readable.
gw-01-copy · Persistence hunting
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.