faq-developer
What happens when a call is not allowed?
Developer FAQ
request
agent/claude-fleet-02
passport tier 3
wants fs.write:/prod
RCX policy check
scope: tools · tenant · tier
per request, not per session
allow · capability token
short-lived, signed, scoped
verifiable offline; expires instead of leaking
deny · RefusalReceipt
signed, with a reason code
fail closed; never a bare 403
Both outcomes mint a receipt, so "who could touch what, when" is a query, not a reconstruction. Enforcement is a property of the wire, not a crippled binary.
RCX is per-request policy. Each call is checked against short-lived capability tokens scoped to tools, tenant, and tier; tokens are self-issued locally and offline-verifiable, so the policy path adds no network dependency.
When a call is out of scope:
- It fails closed. No partial effect, no silent downgrade.
- It mints a signed RefusalReceipt carrying a reason code that names the missing scope. Handle it like any typed error: match on the reason code, surface it, and do not blind-retry, because the refusal is deterministic until the grant changes.
Rollout is gradual via postures: off (no evaluation), observe (verdicts recorded, nothing blocked), enforce (verdicts applied). In observe you get receipted would-refuse records, which is the data you want before turning enforcement on. See the rollout guide.