Execution

Denial reasons

Every machine-readable code an agent can receive.

Plain Denial Reasons returns a machine-readable reason, so an agent can correct its action or stop. All failed checks are returned, not only the first.

Cover#

Code	Meaning
`CERT_MISSING`	No certificate
`ISSUER_UNKNOWN`	Unknown issuer
`SIGNATURE_INVALID`	Invalid signature
`CERT_REVOKED`	Certificate revoked
`CERT_EXPIRED`	Certificate expired
`OUT_OF_SCOPE`	Outside cover scope
`COVER_LIMIT`	Above remaining cover
`EXCLUDED`	Excluded by certificate

Mandate#

Code	Meaning
`NO_MANDATE`	No mandate
`AGENT_FROZEN`	Agent frozen
`SESSION_REVOKED`	Session key revoked
`TX_CAP`	Above transaction cap
`DAILY_ALLOWANCE`	Above daily allowance
`ASSET_BLOCKED`	Asset not allowed
`DESTINATION_BLOCKED`	Destination not allowed
`OUTSIDE_WINDOW`	Outside time window

Simulation#

Code	Meaning
`SIM_BALANCE`	Insufficient balance

Example#

A swap to a destination that is not on the allowlist. Cover passes, and the mandate still enforces.

json

{
  "mode": "dry_run",
  "outcome": "denied",
  "reasons": ["DESTINATION_BLOCKED"],
  "execution": null
}

Each entry in the response's cover and mandate arrays also carries the check name, whether it passed, a readable detail, and its code.