# Access and refusals

Preserve the exact resource, action and state named by a refused operation.

Successful sign-in does not imply a workspace read grant. A refusal names the operation that failed; answer that cause before repeating a call.

## Separate the stages

The executable may run, the MCP host may list tools, and the seat may sign in while roster admission still fails.

**A refused seat admission**

```text
roster failed: refused: Needed: cambium.workspace read
```


An authorised grant holder must give the enrolled agent the workspace read action in Lys. Replacing the key, creating another identity or changing launcher syntax does not provide that grant.

## Read the cause

- `Needed: cambium.workspace read`: The seat signed in but the roster requires a workspace read grant. Have an authorised grant holder supply it in Lys.
- `door_not_open`: The seat transport is available but its door walk has not completed. Read the named step and door address.
- `input_locked`: The field is owned by workflow output. Change the source input or its binding through the served contract.
- `base_moved_since_approval`: The approved base is no longer current. Read the new base and obtain the required approval again.
- `seat_file_exists`: Provisioning refuses to replace an existing seat file. Use the existing identity or choose a new seat deliberately.


## An uncertain write

Keep its submission or operation identifier and read the automation wall or record before retrying. A lost response does not prove that no change occurred. Use the reconciliation or take-back act the current schema provides for that operation.

## A refusal to configure

An unknown key, missing required value or invalid private file is an operator configuration problem. Read [Configuration](/cambium/operations/configuration/) before touching the store or the running service.