Decisions and failures
Auths uses a stable three-way result.
| Decision | Meaning | Application response |
|---|---|---|
Authorized |
Exact authority was established. | Decode the command from the sealed verified action, then apply downstream replay, budget, and execution controls. |
Denied |
Available trustworthy facts establish a stable refusal. | Fail closed. Do not retry unchanged input. |
Indeterminate |
A required trusted fact or supported capability is unavailable. | Do not execute. Acquire the missing fact or install explicit support before retrying. |
Transport failures are not verdicts
Section titled “Transport failures are not verdicts”An exchange timeout, malformed transport frame, unknown challenge, or application refusal must not manufacture an Auths decision. The exchange layer may project a verifier result only when verification actually ran.
Stable codes
Section titled “Stable codes”Portable results include a stable stage and language-neutral code. Use the code for program logic and low-cardinality operations. Human-readable messages are explanatory and may improve without changing the code.