An example EnvoyFilter that turns a user-facing 403 into a 302 redirect, which, in my use case, sent them to a form where they could request access.

envoy-filter.yaml

# Source: istio-gateway/templates/envoy-filter.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: modify-403-to-302
  # replace with the namespace you'd like to target
  namespace: <target-namespace>
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: ADD
        value:
          name: envoy.filters.http.lua
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
            # replace the location header value with your URL
            inline_code: |
              function envoy_on_response(response_handle)
                if (response_handle:headers():get(":status") == "403") then
                  response_handle:logInfo("Got status 403, redirect to landing page...")
                  response_handle:headers():replace(":status", "302")
                  response_handle:headers():add("location", "https://example.com/request-access/")
                end
              end

Accompanies this blog post: https://colinj.hashnode.dev/turn-those-403s-into-302s-using-envoyfilters-and-inline-lua-scripts