# Access and refusals

Use the server refusal to distinguish missing sign-in, a mismatched key and missing authority.

A refusal names the cause and often the field or resource involved. Preserve that answer before changing credentials or asking for new authority.

## Read the answer

**Refusal fields**

```json
{"refusal":"PermissionAbsent","reason":"<the service’s reason>","fields":{}}
```


The reason is the service's explanation. The field structure depends on the refusal; the example shows the envelope, not an exhaustive response schema. The installed OpenAPI supplies the exact shape for each operation.

- `NotSignedIn`: The route has no admitted caller. Use the intended sign-in or the enrolled agent’s own credential.
- `AgentSignatureRefused`: The signed message, enrolled identity or key does not verify. Check that the agent id belongs to the supplied key.
- `PermissionAbsent`: The caller lacks the requested action on the named resource.
- `Revoked / Expired`: The grant or credential no longer provides current authority.
- `ProjectionPending / StaleDecision`: The available decision state is not sufficient for this act. Follow the refusal’s revision or reconciliation information.
- `OperationUnresolved`: The outcome is unresolved. Reconcile the recorded operation before issuing another change.


## Follow the cause

1. Confirm which person or agent the connection is acting as.
2. For a signed request, confirm the agent identifier belongs to the key file supplied to the bridge.
3. Read the resource and action from the failed operation or authority discovery.
4. Have an authorised holder grant that specific action if it is missing.
5. Reconcile an uncertain prior change before submitting another operation.

## Cross-product access

An agent may authenticate to Cambium while lacking the workspace read grant needed for its roster. Correct that authority in Lys. Re-enrolling the agent or switching off product admission does not supply the missing grant.