Docs / Reference
Authorization denial
Return entitlement_denied when subject identity lacks the entitlement required by the capability.
Plain English
This failure mode should return a structured protocol record with entitlement_denied, not an ambiguous framework or transport failure.
Why it exists
Independent callers need to branch on predictable protocol outcomes when a capability cannot safely execute.
Formal definition
A failure mode is a first-class protocol outcome with a stable denial.code or error.code, message, optional details, and evidence semantics.
Concrete example
Ground the concept before the schema.
Planning Agent invokes schedule_technician without service:dispatch permission.
{ "invocation_id": "inv_authz_001", "capability_id": "schedule_technician", "capability_version": "1.0.0", "correlation": { "correlation_id": "case-authz" }, "outcome": "denied", "success": false, "data": null, "error": null, "denial": { "code": "entitlement_denied", "message": "service:dispatch is required.", "retryable": false, "details": { "required_permission": "service:dispatch" } }, "evidence_ids": ["evt_authz_denied"], "started_at": null, "completed_at": "2026-06-16T15:14:22.104Z"}Developer reference
Authorization denial outcome contract
Use this as the minimum machine-readable shape for tests and independent callers.
Planning Agent invokes schedule_technician without service:dispatch permission.
service:dispatch is required.
Evidence type or absence expected for this failure.
Relationships
Where this sits in the protocol.
Each concept should explain its neighbors so implementation teams can preserve the boundary across manifests, invocation, evidence, and tests.
Failure outcomes are produced during discovery, validation, authorization, lifecycle checks, execution, or timeout handling.
Evidence should record the decision path when an invocation reaches the host boundary.
Conformance should include both this failure and the neighboring happy path.
Visual model
- 01Caller sends or discovers a protocol surface.
- 02Host or infrastructure detects the failure condition.
- 03Caller receives entitlement_denied with structured details.
Implementation notes
- Return a stable code that callers can match programmatically.
- Include a human-readable message without depending on it for control flow.
- Attach evidence when the host boundary received and evaluated the request.
Common mistakes
- Throwing a raw exception instead of a protocol outcome.
- Using different codes for the same failure across hosts.
- Omitting evidence for denied or rejected requests that reached policy or lifecycle checks.
Related concepts