AuthoritySubjectMalformedauthority.identify.malformed-valueA value failing value-hygiene raises AuthoritySubjectMalformed, except that the command-line mint trims a padded value where the automated exchange refuses it. | A subject value fails mint hygiene, or arrives padded on the exchange. | authority.identify.malformed-valueauthority.identify.malformed-valueA value failing value-hygiene raises AuthoritySubjectMalformed, except that the command-line mint trims a padded value where the automated exchange refuses it. |
AuthoritySubjectMissingauthority.identify.subject-missingA credential carrying no subject member raises AuthoritySubjectMissing at admission, naming the refusing surface and echoing no credential value. | A credential carries no subject member. | authority.identify.subject-missingauthority.identify.subject-missingA credential carrying no subject member raises AuthoritySubjectMissing at admission, naming the refusing surface and echoing no credential value. |
AuthorityLinkUnverifiedauthority.identify.unverified-linkOnly scim_email and oidc_sub links authorize. An authorization join consuming an operator_asserted LinkMethod raises AuthorityLinkUnverified. | An authorization join consumed a link whose method does not authorize. | authority.identify.unverified-linkauthority.identify.unverified-linkOnly scim_email and oidc_sub links authorize. An authorization join consuming an operator_asserted LinkMethod raises AuthorityLinkUnverified. |
AuthoritySubjectReboundauthority.identify.subject-reboundA derivation naming an on_behalf_of different from its parent's raises AuthoritySubjectRebound. | A derivation names a different on-behalf-of principal. | authority.identify.subject-reboundauthority.identify.subject-reboundA derivation naming an on_behalf_of different from its parent's raises AuthoritySubjectRebound. |
ProfileElementUnrecognizedauthority.profile.unrecognized-elementA credential carrying a block version, predicate, rule or restriction the profile does not name raises ProfileElementUnrecognized. | A credential element the profile does not name. | authority.profile.unrecognized-elementauthority.profile.unrecognized-elementA credential carrying a block version, predicate, rule or restriction the profile does not name raises ProfileElementUnrecognized. |
ProfileReservedFactauthority.profile.reserved-factCurrent time, audience, resolved resources and authenticated request identity are reserved facts the engine supplies. A token block introducing one raises ProfileReservedFact. | A token block introduces an engine-reserved fact. | authority.profile.reserved-factauthority.profile.reserved-factCurrent time, audience, resolved resources and authenticated request identity are reserved facts the engine supplies. A token block introducing one raises ProfileReservedFact. |
ProfileEvaluationBudgetauthority.profile.evaluator-boundThe evaluator runs with no third-party block, external function, recursion or regular-expression predicate. Input past fact-ceiling or iteration-ceiling raises ProfileEvaluationBudget. | Evaluator input past the fact or iteration ceiling. | authority.profile.evaluator-boundauthority.profile.evaluator-boundThe evaluator runs with no third-party block, external function, recursion or regular-expression predicate. Input past fact-ceiling or iteration-ceiling raises ProfileEvaluationBudget. |
ProfileRestrictionUnevaluatedauthority.profile.unevaluated-restrictionA grant carrying a row restriction or aggregate bound with no read evaluator raises ProfileRestrictionUnevaluated at the mint, at derivation on parent and child, and at admission. | A restriction no read evaluator exists for. | authority.profile.unevaluated-restrictionauthority.profile.unevaluated-restrictionA grant carrying a row restriction or aggregate bound with no read evaluator raises ProfileRestrictionUnevaluated at the mint, at derivation on parent and child, and at admission. |
ProfileVersionUnsupportedauthority.profile.version-unsupportedA checkpoint reading a profile version outside its supported set raises ProfileVersionUnsupported. Widening the profile mints a new version. | A profile version outside the checkpoint’s supported set. | authority.profile.version-unsupportedauthority.profile.version-unsupportedA checkpoint reading a profile version outside its supported set raises ProfileVersionUnsupported. Widening the profile mints a new version. |
GrantActionUnknownauthority.grant.unknown-actionAn action outside the vocabulary raises GrantActionUnknown at the mint and at admission. | An action outside the registered vocabulary. | authority.grant.unknown-actionauthority.grant.unknown-actionAn action outside the vocabulary raises GrantActionUnknown at the mint and at admission. |
GrantPatternMalformedauthority.grant.malformed-patternA pattern with anywhere but its final position raises GrantPatternMalformed. | A table pattern with a star before its final position. | authority.grant.malformed-patternauthority.grant.malformed-patternA pattern with anywhere but its final position raises GrantPatternMalformed. |
GrantTenantUnbindableauthority.grant.tenant-unbindableA tenant-scoped grant on a table declaring no bare outermost partition column raises GrantTenantUnbindable at admission. | A tenant scope on a table with no bare outermost partition column. | authority.grant.tenant-unbindableauthority.grant.tenant-unbindableA tenant-scoped grant on a table declaring no bare outermost partition column raises GrantTenantUnbindable at admission. |
GrantTemplateNotAllowedauthority.grant.template-not-allowedInvoking a template outside the allowlist raises GrantTemplateNotAllowed, and an uncovered template is absent from the projected tool listing. | A query template outside the credential’s allowlist. | authority.grant.template-not-allowedauthority.grant.template-not-allowedInvoking a template outside the allowlist raises GrantTemplateNotAllowed, and an uncovered template is absent from the projected tool listing. |
GrantPipelineNotCoveredauthority.grant.pipeline-not-coveredDescribing an uncovered pipeline raises GrantPipelineNotCovered, naming it. Listing filters to covered identifiers and raises it when none is covered; a project declaring no pipelines lists empty. | A pipeline identifier no grant covers. | authority.grant.pipeline-not-coveredauthority.grant.pipeline-not-coveredDescribing an uncovered pipeline raises GrantPipelineNotCovered, naming it. Listing filters to covered identifiers and raises it when none is covered; a project declaring no pipelines lists empty. |
GrantRunTraceDeniedauthority.grant.run-trace-deniedTracing a run gates on the pipeline resolved from the run record and raises GrantRunTraceDenied without naming that pipeline. | A run trace whose pipeline no grant covers; names no pipeline. | authority.grant.run-trace-deniedauthority.grant.run-trace-deniedTracing a run gates on the pipeline resolved from the run record and raises GrantRunTraceDenied without naming that pipeline. |
GrantWriteNotCoveredauthority.grant.write-not-coveredA credentialed table write whose grants carry no write over a destination table raises GrantWriteNotCovered, naming the table, before its first effect. | A credentialed table write with no write grant over its destination. | authority.grant.write-not-coveredauthority.grant.write-not-coveredA credentialed table write whose grants carry no write over a destination table raises GrantWriteNotCovered, naming the table, before its first effect. |
AttenuationWidensauthority.attenuate.widensA child broader than its parent on actions, tables, templates, aggregate constraints, or a max_rows, max_duration_ms or max_response_bytes ceiling raises AttenuationWidens, naming the dimension. | A child broader than its parent on a grant dimension. | authority.attenuate.widensauthority.attenuate.widensA child broader than its parent on actions, tables, templates, aggregate constraints, or a max_rows, max_duration_ms or max_response_bytes ceiling raises AttenuationWidens, naming the dimension. |
AttenuationExpiryExtendedauthority.attenuate.expiry-extendedA child whose expiry falls past its parent's raises AttenuationExpiryExtended. | A child expiry past its parent’s. | authority.attenuate.expiry-extendedauthority.attenuate.expiry-extendedA child whose expiry falls past its parent's raises AttenuationExpiryExtended. |
AttenuationTenantDroppedauthority.attenuate.tenant-droppedA child dropping its parent's tenant scope or naming another tenant raises AttenuationTenantDropped. Adding a scope to an unscoped parent narrows. | A child dropping or changing its parent’s tenant scope. | authority.attenuate.tenant-droppedauthority.attenuate.tenant-droppedA child dropping its parent's tenant scope or naming another tenant raises AttenuationTenantDropped. Adding a scope to an unscoped parent narrows. |
IssuanceLifetimeAboveCeilingauthority.issue.above-ceilingAn explicitly requested lifetime above the persisted ceiling raises IssuanceLifetimeAboveCeiling; an exchange policy's lifetime clamps down to the ceiling instead. | A requested lifetime above the persisted ceiling. | authority.issue.above-ceilingauthority.issue.above-ceilingAn explicitly requested lifetime above the persisted ceiling raises IssuanceLifetimeAboveCeiling; an exchange policy's lifetime clamps down to the ceiling instead. |
IssuancePolicyExistsauthority.issue.policy-initcontextful token policy init writes the issuance policy naming its audience with a ceiling of the bearer-lifetime bound; over an existing policy it raises IssuancePolicyExists and writes nothing. | A policy init over an existing issuance policy. | authority.issue.policy-initauthority.issue.policy-initcontextful token policy init writes the issuance policy naming its audience with a ceiling of the bearer-lifetime bound; over an existing policy it raises IssuancePolicyExists and writes nothing. |
IssuanceCeilingNotLoweredauthority.issue.lower-onlycontextful token policy lower-ceiling naming a value at or above the current ceiling raises IssuanceCeilingNotLowered and leaves the policy unchanged. | A ceiling lowering to a value at or above the current ceiling. | authority.issue.lower-onlyauthority.issue.lower-onlycontextful token policy lower-ceiling naming a value at or above the current ceiling raises IssuanceCeilingNotLowered and leaves the policy unchanged. |
IssuancePrincipalRequiredauthority.issue.principal-requiredA mint granting write, execute or forget whose subject names no on_behalf_of raises IssuancePrincipalRequired. | An attributed-effect grant naming no on-behalf-of principal. | authority.issue.principal-requiredauthority.issue.principal-requiredA mint granting write, execute or forget whose subject names no on_behalf_of raises IssuancePrincipalRequired. |
AuthoringPostureUndeclaredauthority.issue.posture-keyA manifest declares its authoring posture as a top-level authoring_posture of session or per_request. A table write verb reading a manifest whose key is absent or names another value raises AuthoringPostureUndeclared before its first effect. | A table write verb reading a manifest with no valid authoring posture. | authority.issue.posture-keyauthority.issue.posture-keyA manifest declares its authoring posture as a top-level authoring_posture of session or per_request. A table write verb reading a manifest whose key is absent or names another value raises AuthoringPostureUndeclared before its first effect. |
AuthoringCredentialMissingauthority.issue.session-credentialUnder session, a table write verb run with no credential raises AuthoringCredentialMissing before its first effect. | A table write verb under the session posture with no credential. | authority.issue.session-credentialauthority.issue.session-credentialUnder session, a table write verb run with no credential raises AuthoringCredentialMissing before its first effect. |
IssuerKeyMissingauthority.issue.missing-keyA face configured with no issuer key raises IssuerKeyMissing, prints the command that fixes it, and binds no port. | A face configured with no issuer key. | authority.issue.missing-keyauthority.issue.missing-keyA face configured with no issuer key raises IssuerKeyMissing, prints the command that fixes it, and binds no port. |
IssuerKeyUnresolvableauthority.issue.unresolvable-keyA set issuer key reference that resolves to no material raises IssuerKeyUnresolvable; no local key is fabricated. | An issuer key reference resolving to no material. | authority.issue.unresolvable-keyauthority.issue.unresolvable-keyA set issuer key reference that resolves to no material raises IssuerKeyUnresolvable; no local key is fabricated. |
IssuanceUnauthorizedauthority.issue.unauthorized-mintA mint request presenting no grant carrying admin raises IssuanceUnauthorized. | A mint request without an admin grant. | authority.issue.unauthorized-mintauthority.issue.unauthorized-mintA mint request presenting no grant carrying admin raises IssuanceUnauthorized. |
ReplicaCannotIssueauthority.issue.replica-mintA replica holds the issuer's public key and no signing material; a mint there raises ReplicaCannotIssue. | A mint attempted on a replica. | authority.issue.replica-mintauthority.issue.replica-mintA replica holds the issuer's public key and no signing material; a mint there raises ReplicaCannotIssue. |
IssuanceZoneWildcardauthority.issue.zone-wildcardA mint whose subject declares a wildcard inference zone raises IssuanceZoneWildcard. | A subject declaring a wildcard inference zone at the mint. | authority.issue.zone-wildcardauthority.issue.zone-wildcardA mint whose subject declares a wildcard inference zone raises IssuanceZoneWildcard. |
SignatureEncodingInvalidauthority.issue.encoding-invalidA port signature that does not decode under its encoding tag, or does not verify under the port's public key, raises SignatureEncodingInvalid; nothing is minted and no root or tip is written. | A port signature that does not decode under its tag or verify under the port’s key. | authority.issue.encoding-invalidauthority.issue.encoding-invalidA port signature that does not decode under its encoding tag, or does not verify under the port's public key, raises SignatureEncodingInvalid; nothing is minted and no root or tip is written. |
SignatureAlgorithmMismatchauthority.issue.algorithm-mismatchA credential naming a scheme other than its pinned key's raises SignatureAlgorithmMismatch. | A named scheme differing from the pinned key’s. | authority.issue.algorithm-mismatchauthority.issue.algorithm-mismatchA credential naming a scheme other than its pinned key's raises SignatureAlgorithmMismatch. |
IssuerKeyRotationNotDueauthority.issue.rotation-not-dueA rotation without --compromise before key-rotation falls due raises IssuerKeyRotationNotDue, naming the instant it falls due. | A scheduled rotation before the cadence falls due. | authority.issue.rotation-not-dueauthority.issue.rotation-not-dueA rotation without --compromise before key-rotation falls due raises IssuerKeyRotationNotDue, naming the instant it falls due. |
IssuerKeyUnrecordedauthority.issue.unrecorded-keyA rotation without --compromise of an issuer key the key-set ledger does not date raises IssuerKeyUnrecorded; contextful token record --since dates it. | A scheduled rotation of a key the ledger does not date. | authority.issue.unrecorded-keyauthority.issue.unrecorded-keyA rotation without --compromise of an issuer key the key-set ledger does not date raises IssuerKeyUnrecorded; contextful token record --since dates it. |
SignatureInvalidauthority.verify.bad-signatureA credential with any block signature failing against a pinned key raises SignatureInvalid and admits nothing, no verified prefix included. | A block signature failing against every pinned key. | authority.verify.bad-signatureauthority.verify.bad-signatureA credential with any block signature failing against a pinned key raises SignatureInvalid and admits nothing, no verified prefix included. |
AudienceMismatchauthority.verify.audience-mismatchA checkpoint declaring an expected audience raises AudienceMismatch for a credential with a different audience or none; a checkpoint declaring none performs no audience check. | A credential audience differing from, or absent against, the declared one. | authority.verify.audience-mismatchauthority.verify.audience-mismatchA checkpoint declaring an expected audience raises AudienceMismatch for a credential with a different audience or none; a checkpoint declaring none performs no audience check. |
TimestampMalformedauthority.verify.malformed-timestampA timestamp that does not decode under that grammar raises TimestampMalformed at every checkpoint alike. | A credential timestamp outside the timestamp grammar. | authority.verify.malformed-timestampauthority.verify.malformed-timestampA timestamp that does not decode under that grammar raises TimestampMalformed at every checkpoint alike. |
AuthorityExpiredauthority.verify.expiredA credential whose expiry precedes the evaluation instant raises AuthorityExpired at admission and at each later effect boundary. | A credential past its expiry at admission or an effect boundary. | authority.verify.expiredauthority.verify.expiredA credential whose expiry precedes the evaluation instant raises AuthorityExpired at admission and at each later effect boundary. |
PossessionProofInvalidauthority.verify.possession-invalidA request whose proof does not verify against the confirmation thumbprint raises PossessionProofInvalid. | A request proof failing against the confirmation thumbprint. | authority.verify.possession-invalidauthority.verify.possession-invalidA request whose proof does not verify against the confirmation thumbprint raises PossessionProofInvalid. |
PossessionProofReplayedauthority.verify.replayed-nonceA proof whose nonce repeats inside the replay window raises PossessionProofReplayed. | A proof nonce repeated inside the replay window. | authority.verify.replayed-nonceauthority.verify.replayed-nonceA proof whose nonce repeats inside the replay window raises PossessionProofReplayed. |
BearerLifetimeExceededauthority.verify.bearer-lifetimeA bearer whose expiry falls more than 3600 s after its issue instant raises BearerLifetimeExceeded at a network checkpoint and admits nothing; its holder refreshes through surface. | A bearer living longer than a network checkpoint admits. | authority.verify.bearer-lifetimeauthority.verify.bearer-lifetimeA bearer whose expiry falls more than 3600 s after its issue instant raises BearerLifetimeExceeded at a network checkpoint and admits nothing; its holder refreshes through surface. |
TransportPeerMismatchauthority.verify.peer-mismatchA socket peer presenting a credential with no confirmation claim, whose kernel-reported uid differs from the checkpoint process's uid or which the platform cannot report, raises TransportPeerMismatch and admits nothing. | A socket peer, holding a credential with no confirmation claim, whose uid differs from the checkpoint’s or is unreportable; a request on a connection other than the admitted one. | authority.verify.peer-mismatchauthority.verify.peer-mismatchA socket peer presenting a credential with no confirmation claim, whose kernel-reported uid differs from the checkpoint process's uid or which the platform cannot report, raises TransportPeerMismatch and admits nothing. |
KeySetUnavailableauthority.verify.key-set-unavailableA checkpoint opted into a published key set that obtains none, or holding a malformed pin, raises KeySetUnavailable: the engine declines to start and a gateway answers 503. | An opted-into published key set that could not be obtained, or a malformed pin. | authority.verify.key-set-unavailableauthority.verify.key-set-unavailableA checkpoint opted into a published key set that obtains none, or holding a malformed pin, raises KeySetUnavailable: the engine declines to start and a gateway answers 503. |
KeySetStaleauthority.verify.key-set-staleAfter a failed fetch the last-known-good set serves while its age since the last successful fetch stays under 1 h; past that the checkpoint raises KeySetStale. | A last-known-good key set past its staleness bound. | authority.verify.key-set-staleauthority.verify.key-set-staleAfter a failed fetch the last-known-good set serves while its age since the last successful fetch stays under 1 h; past that the checkpoint raises KeySetStale. |
KeySetLedgerUnavailableauthority.revoke.ledger-unavailableA checkpoint pointed at a key-set ledger, or that has read one, raises KeySetLedgerUnavailable and admits nothing once the file is absent or malformed. | A required key-set ledger absent or malformed. | authority.revoke.ledger-unavailableauthority.revoke.ledger-unavailableA checkpoint pointed at a key-set ledger, or that has read one, raises KeySetLedgerUnavailable and admits nothing once the file is absent or malformed. |
RevocationPrincipalClassUnknownauthority.revoke.unknown-principal-classcontextful token revoke --principal-class naming neither delegated nor unattributed raises RevocationPrincipalClassUnknown and bumps nothing. | An epoch bump naming an unknown principal class. | authority.revoke.unknown-principal-classauthority.revoke.unknown-principal-classcontextful token revoke --principal-class naming neither delegated nor unattributed raises RevocationPrincipalClassUnknown and bumps nothing. |
AuthorityRevokedauthority.revoke.revokedA credential on the denylist, or carrying an epoch below the current scoped epoch, raises AuthorityRevoked at the next effect boundary. | A denylisted credential, or one below the current scoped epoch. | authority.revoke.revokedauthority.revoke.revokedA credential on the denylist, or carrying an epoch below the current scoped epoch, raises AuthorityRevoked at the next effect boundary. |
RotationGraceTooShortauthority.revoke.short-graceA declared or overridden grace window shorter than the effective issuance ceiling raises RotationGraceTooShort. | A rotation grace window shorter than the issuance ceiling. | authority.revoke.short-graceauthority.revoke.short-graceA declared or overridden grace window shorter than the effective issuance ceiling raises RotationGraceTooShort. |
CredentialFormatWithdrawnauthority.revoke.format-withdrawnFrom a declared cutover instant, every admission path raises CredentialFormatWithdrawn for a credential in a withdrawn format. Only an explicit declaration restores acceptance. | A credential in a withdrawn format. | authority.revoke.format-withdrawnauthority.revoke.format-withdrawnFrom a declared cutover instant, every admission path raises CredentialFormatWithdrawn for a credential in a withdrawn format. Only an explicit declaration restores acceptance. |
ExchangeRequestMalformedauthority.exchange.wireAn exchange request body is the JSON object {"jwt": "<assertion>"}, which the command line builds from its assertion; a body of any other shape raises ExchangeRequestMalformed and mints nothing. A served face answers a mint {"token": "<credential>"}. | An exchange request body of any shape but a lone jwt string member. | authority.exchange.wireauthority.exchange.wireAn exchange request body is the JSON object {"jwt": "<assertion>"}, which the command line builds from its assertion; a body of any other shape raises ExchangeRequestMalformed and mints nothing. A served face answers a mint {"token": "<credential>"}. |
ExchangeBodyTooLargeauthority.exchange.body-ceilingAn exchange request body holds at most 64 KiB; a longer body raises ExchangeBodyTooLarge, mints nothing and is not parsed. | An exchange request body past the ceiling. | authority.exchange.body-ceilingauthority.exchange.body-ceilingAn exchange request body holds at most 64 KiB; a longer body raises ExchangeBodyTooLarge, mints nothing and is not parsed. |
ExchangeUnconfiguredauthority.exchange.unconfiguredAn exchange in a project declaring no exchange policy raises ExchangeUnconfigured, naming .contextful/exchange/policy.toml, before the body is read. | An exchange in a project declaring no exchange policy. | authority.exchange.unconfiguredauthority.exchange.unconfiguredAn exchange in a project declaring no exchange policy raises ExchangeUnconfigured, naming .contextful/exchange/policy.toml, before the body is read. |
ExchangeAssertionInvalidauthority.exchange.assertion-invalidA bad signature, a lapsed assertion, an untrusted issuer or audience, or a mapped claim absent from the assertion raises ExchangeAssertionInvalid and mints nothing. | An external assertion failing any exchange check. | authority.exchange.assertion-invalidauthority.exchange.assertion-invalidA bad signature, a lapsed assertion, an untrusted issuer or audience, or a mapped claim absent from the assertion raises ExchangeAssertionInvalid and mints nothing. |
ExchangeMaterialMissingauthority.exchange.material-missingAn exchange configured with no verifying material raises ExchangeMaterialMissing and mints nothing. | An exchange configured with no verifying material. | authority.exchange.material-missingauthority.exchange.material-missingAn exchange configured with no verifying material raises ExchangeMaterialMissing and mints nothing. |
ExchangeHolderProofInvalidauthority.exchange.holder-proof-invalidAn exchange request whose proof fails any check of holder-binding, a replayed nonce included, raises ExchangeHolderProofInvalid and mints nothing. | An exchange request whose holder proof fails verification. | authority.exchange.holder-proof-invalidauthority.exchange.holder-proof-invalidAn exchange request whose proof fails any check of holder-binding, a replayed nonce included, raises ExchangeHolderProofInvalid and mints nothing. |
EnforceRedactionInvalidauthority.redact.pattern-refusalUnsupported syntax, Unicode word boundaries, empty matches or a pattern past pattern-bytes or compiled-pattern-size raises EnforceRedactionInvalid at declaration. | A removal rule has an unsupported or unbounded pattern. | authority.redact.pattern-refusalauthority.redact.pattern-refusalUnsupported syntax, Unicode word boundaries, empty matches or a pattern past pattern-bytes or compiled-pattern-size raises EnforceRedactionInvalid at declaration. |
EnforcePredicateOutsideGrammarauthority.filter-rows.outside-grammarPredicates parse at manifest load; a node outside the grammar raises EnforcePredicateOutsideGrammar, naming the node. | A row predicate node outside the typed subset. | authority.filter-rows.outside-grammarauthority.filter-rows.outside-grammarPredicates parse at manifest load; a node outside the grammar raises EnforcePredicateOutsideGrammar, naming the node. |
EnforceUnknownClassauthority.mask.unknown-classA class outside the registry raises EnforceUnknownClass at manifest check. | A column class outside the class registry. | authority.mask.unknown-classauthority.mask.unknown-classA class outside the registry raises EnforceUnknownClass at manifest check. |
EnforceDigestAloneOnExhaustibleClassauthority.mask.digest-alonehash or tokenize standing alone over an exhaustible class raises EnforceDigestAloneOnExhaustibleClass. | A keyed hash standing alone over an exhaustible class. | authority.mask.digest-aloneauthority.mask.digest-alonehash or tokenize standing alone over an exhaustible class raises EnforceDigestAloneOnExhaustibleClass. |
EnforceCombineWithoutGeneralizationauthority.mask.combine-generalizesA bucket or range combine behind hash or tokenize raises EnforceCombineWithoutGeneralization; truncate is the one combine that generalizes a digest. | A combine leaving its primary’s digest output unchanged. | authority.mask.combine-generalizesauthority.mask.combine-generalizesA bucket or range combine behind hash or tokenize raises EnforceCombineWithoutGeneralization; truncate is the one combine that generalizes a digest. |
EnforceStrategyOutsideTypeauthority.mask.typed-strategyA binary column masks by drop or by hash over its bytes, a vector or nested column by drop alone over the whole column; another strategy on either raises EnforceStrategyOutsideType at manifest load. | A mask strategy a binary or vector column’s type does not admit. | authority.mask.typed-strategyauthority.mask.typed-strategyA binary column masks by drop or by hash over its bytes, a vector or nested column by drop alone over the whole column; another strategy on either raises EnforceStrategyOutsideType at manifest load. |
EnforceMaskOnAbsentColumnauthority.mask.absent-columnA mask naming a column the table's schema omits raises EnforceMaskOnAbsentColumn at manifest load, refusing the whole manifest. | A mask naming a column the schema omits. | authority.mask.absent-columnauthority.mask.absent-columnA mask naming a column the table's schema omits raises EnforceMaskOnAbsentColumn at manifest load, refusing the whole manifest. |
EnforceTruncationCutsNothingauthority.mask.cuts-nothingA truncate combine at or past its primary's output width raises EnforceTruncationCutsNothing. | A truncation width at or past the primary’s output width. | authority.mask.cuts-nothingauthority.mask.cuts-nothingA truncate combine at or past its primary's output width raises EnforceTruncationCutsNothing. |
EnforceTruncationTooWideauthority.mask.truncation-ceilingBehind a keyed digest over an exhaustible class, a truncate width above floor(log_b(domain ÷ crowd)), b being 16 for hash and 36 for tokenize, with domain from the class registry, raises EnforceTruncationTooWide. | A digest truncation wider than the class domain and crowd admit. | authority.mask.truncation-ceilingauthority.mask.truncation-ceilingBehind a keyed digest over an exhaustible class, a truncate width above floor(log_b(domain ÷ crowd)), b being 16 for hash and 36 for tokenize, with domain from the class registry, raises EnforceTruncationTooWide. |
EnforceKeyMaterialInRelationauthority.mask.key-materialA compiled relation, query plan or session catalog entry carrying pepper-derived key state raises EnforceKeyMaterialInRelation. | Pepper-derived key state in relation text, a plan or the session catalog. | authority.mask.key-materialauthority.mask.key-materialA compiled relation, query plan or session catalog entry carrying pepper-derived key state raises EnforceKeyMaterialInRelation. |
EnforceScopeDeniedauthority.refuse.scope-deniedA tenant-scoped credential reading another tenant's rows on a granted table raises EnforceScopeDenied, as wire code scope_denied, HTTP 403 or an in-band tool error, naming the table and both scopes. | A read of another tenant’s rows on a granted table. | authority.refuse.scope-deniedauthority.refuse.scope-deniedA tenant-scoped credential reading another tenant's rows on a granted table raises EnforceScopeDenied, as wire code scope_denied, HTTP 403 or an in-band tool error, naming the table and both scopes. |
EnforceUnknownRelationauthority.refuse.ungranted-tableA relation the caller holds no grant on, whether or not a table of that name exists, raises EnforceUnknownRelation and is absent from listings and descriptions. | A read naming a table the caller holds no grant on. | authority.refuse.ungranted-tableauthority.refuse.ungranted-tableA relation the caller holds no grant on, whether or not a table of that name exists, raises EnforceUnknownRelation and is absent from listings and descriptions. |
EnforceRootObjectNotAllowlistedauthority.bound-redistribution.root-not-allowlistedA root-level object absent from the allowlist raises EnforceRootObjectNotAllowlisted at push. | A root-level object pushed outside the allowlist while a table is withheld. | authority.bound-redistribution.root-not-allowlistedauthority.bound-redistribution.root-not-allowlistedA root-level object absent from the allowlist raises EnforceRootObjectNotAllowlisted at push. |
EnforceStaleRedistributedObjectsauthority.bound-redistribution.left-behindClearing the flag over a table an earlier push uploaded raises EnforceStaleRedistributedObjects, naming each object and the remedy, deleting none. | Objects an earlier push left addressable for a now-withheld table. | authority.bound-redistribution.left-behindauthority.bound-redistribution.left-behindClearing the flag over a table an earlier push uploaded raises EnforceStaleRedistributedObjects, naming each object and the remedy, deleting none. |
EnforceZonePatternUnparsedauthority.place.unparsed-patternAn allow-set entry matching no entry form raises EnforceZonePatternUnparsed, naming the entry. | An allow-set entry matching no entry form. | authority.place.unparsed-patternauthority.place.unparsed-patternAn allow-set entry matching no entry form raises EnforceZonePatternUnparsed, naming the entry. |
EnforceZoneAssertionWidensauthority.place.asserted-zoneA zone a request asserts stands only where it equals the zone its credential signs; any other assertion raises EnforceZoneAssertionWidens, naming both. | A request asserted a zone its credential does not sign. | authority.place.asserted-zoneauthority.place.asserted-zoneA zone a request asserts stands only where it equals the zone its credential signs; any other assertion raises EnforceZoneAssertionWidens, naming both. |
EnforceProtectedFloorWidenedauthority.place.floor-widenedA manifest widening a protected-class surface past its floor without an override naming that class raises EnforceProtectedFloorWidened. | A protected-class surface widened past its floor with no override. | authority.place.floor-widenedauthority.place.floor-widenedA manifest widening a protected-class surface past its floor without an override naming that class raises EnforceProtectedFloorWidened. |
EnforceRemovalWithPublicCloudauthority.place.removal-with-public-cloudA surface declaring write-time removal on a column and an allow-set admitting a public cloud raises EnforceRemovalWithPublicCloud. | Write-time removal and a public-cloud allow-set on one surface. | authority.place.removal-with-public-cloudauthority.place.removal-with-public-cloudA surface declaring write-time removal on a column and an allow-set admitting a public cloud raises EnforceRemovalWithPublicCloud. |
EnforceEvidenceFloorExceededauthority.place.evidence-floorA synthesized row declaring a set wider than the intersection of its evidence tables' sets raises EnforceEvidenceFloorExceeded and resolves to that intersection. | A synthesized row declaring a set wider than its evidence intersection. | authority.place.evidence-floorauthority.place.evidence-floorA synthesized row declaring a set wider than the intersection of its evidence tables' sets raises EnforceEvidenceFloorExceeded and resolves to that intersection. |
EnforceEvidenceListEmptyauthority.place.empty-evidenceA synthesized row naming no evidence table raises EnforceEvidenceListEmpty and resolves to the fail-closed pair of fail-closed. | A synthesized row naming no evidence table. | authority.place.empty-evidenceauthority.place.empty-evidenceA synthesized row naming no evidence table raises EnforceEvidenceListEmpty and resolves to the fail-closed pair of fail-closed. |
EnforceIncognitoWideningauthority.place.incognito-wideningA session asserting a zone wider than the incognito pin, or an incognito contextful token mint signing one, raises EnforceIncognitoWidening. | A session asserting a zone wider than the incognito pin. | authority.place.incognito-wideningauthority.place.incognito-wideningA session asserting a zone wider than the incognito pin, or an incognito contextful token mint signing one, raises EnforceIncognitoWidening. |
EnforceZoneDefaultWidenedauthority.place.default-widenedUnder users_may_widen = false, a contextful token mint signing a zone other than the project's default or local:device raises EnforceZoneDefaultWidened, naming both. | A mint signing a zone other than a non-widenable project default. | authority.place.default-widenedauthority.place.default-widenedUnder users_may_widen = false, a contextful token mint signing a zone other than the project's default or local:device raises EnforceZoneDefaultWidened, naming both. |
EnforceCredentialShapedValueauthority.resist.credential-shaped-valueA claim write, direct or synthesized, raises EnforceCredentialShapedValue on a field matching a credential shape, before it reaches storage. | A credential-shaped value on the write path. | authority.resist.credential-shaped-valueauthority.resist.credential-shaped-valueA claim write, direct or synthesized, raises EnforceCredentialShapedValue on a field matching a credential shape, before it reaches storage. |
EnforceWriteOnReadOnlyFaceauthority.resist.write-toolRegistering a write tool on an organization-wide face raises EnforceWriteOnReadOnlyFace. | A write tool registered on an organization-wide face. | authority.resist.write-toolauthority.resist.write-toolRegistering a write tool on an organization-wide face raises EnforceWriteOnReadOnlyFace. |