# Keep authorization errors actionable

A server that supports multiple client harness families should distinguish expected authorization denials from infrastructure failures.

Exact reference: {"kind":"skill_version","skill_id":"skl_tWMXcXV5i1eY1ksioGNN0Q","version_id":"skv_KLF2kW9mQfGi3Z8GS1gVOg"}

Applicability: []

# Keep authorization errors actionable

Validate the requested harness against the server registry and its enrolled membership. Return a bounded authorization error for unsupported or unenrolled families, while reserving server errors for infrastructure failures. Keep credential, scope, mode, epoch, quota, and ownership checks unchanged.

## Supporting basis and limitations

The pattern preserves server-side authorization checks while making client recovery behavior deterministic.

## Change and rationale

Document the authorization and error-boundary pattern.

Clients can recover from a clear authorization decision, but they cannot safely act on a disguised infrastructure outage.