The six outcomes

An authorisation returns one of six outcomes. They are not collapsed into allowed/refused because the four refusal shapes send an operator to completely different places.

Outcome	Allowed	What it means	What to do
`allow`	yes	Within the grant.	Proceed.
`deny`	no	Policy refused it.	A policy conversation.
`exhausted`	no	Permitted, but the allowance is spent.	Retrying cannot help. Escalate or wait for the window.
`gated`	no	Untrusted content entered and this action needs a clean context.	Escalate; see Clean context.
`review_sync`	pending	A person must decide before the action.	Block and surface the review.
`review_async`	pending	A person must decide, but not on this path.	Park and continue.

deny and exhausted are the pair most often merged by other systems, and merging them costs you the diagnosis. “You were not allowed to do that” and “you had run out” have different remedies and different owners.

Each maps to an exception in the SDK. See Errors.

⌘I

Getting started

Core concepts

Guides

Integrations