Variable: ACCESS_DENY_REASONS

const ACCESS_DENY_REASONS: readonly ["tenant_mismatch", "schema_mismatch", "unlisted_edge", "actor_unverified", "platform_grant_missing", "scope_denied", "principal_unknown", "issuer_not_accepted"]

Defined in: packages/contracts/src/schemas/audit-actions.ts:72

Why a request was refused, as a version 1 access.deny payload records it (09, widened to seven, and to eight by issuer_not_accepted, which only the gateway files: a token of the other population's realm presented to a route, D1.4).

Frozen: v1 records exist, so this list never changes again. A ninth reason made ACCESS_DENY_REASONS_V2. The receiver in packages/messaging derives its DenyReason from one of the two lists, so the two cannot drift.