---
title: "authz. diagnostics"
description: "Owner: the authz spec (defs/authz.ts). The status is the code's own; the exit comes from its category (CATEGORIES). A warning or info code never sets the status or the exit."
order: 6
---

# `authz.*` diagnostics

Owner: the authz spec (`defs/authz.ts`). The status is the code's own; the exit comes from its category (`CATEGORIES`). A warning or info code never sets the status or the exit.

| Code | Category | Severity | Status | Exit | Retry | Fix | Args |
|---|---|---|---|---|---|---|---|
| <a id="authz.approve_needs_owner"></a>`authz.approve_needs_owner` | policy | error | 403 | 4 | no | — | `role` |
| <a id="authz.approve_needs_person"></a>`authz.approve_needs_person` | policy | error | 403 | 4 | no | — | — |
| <a id="authz.break_glass_access_change"></a>`authz.break_glass_access_change` | policy | error | 403 | 4 | no | — | — |
| <a id="authz.catalog_names_member"></a>`authz.catalog_names_member` | policy | error | 403 | 4 | no | — | — |
| <a id="authz.catalog_needs_full_read"></a>`authz.catalog_needs_full_read` | policy | error | 403 | 4 | no | — | `type` |
| <a id="authz.declarer_lost_standing"></a>`authz.declarer_lost_standing` | state | error | 409 | 5 | no | — | `trigger`, `declarer` |
| <a id="authz.denied"></a>`authz.denied` | policy | error | 403 | 4 | no | — | `op`, `on` |
| <a id="authz.grant_exceeds_holder"></a>`authz.grant_exceeds_holder` | policy | error | 403 | 4 | no | — | `atom`, `missing`, `props?` |
| <a id="authz.member_op_subject"></a>`authz.member_op_subject` | reference | error | 400 | 2 | no | — | `rule`, `op`, `subject` |
| <a id="authz.org_mismatch_defect"></a>`authz.org_mismatch_defect` | platform | error | 500 | 1 | no | — | — |
| <a id="authz.platform_permit"></a>`authz.platform_permit` | reference | error | 400 | 2 | no | — | `rule`, `target` |
| <a id="authz.platform_relation"></a>`authz.platform_relation` | reference | error | 400 | 2 | no | — | `rule`, `target` |
| <a id="authz.rewind_needs_owner"></a>`authz.rewind_needs_owner` | policy | error | 403 | 4 | no | — | `role` |
| <a id="authz.row_rule_cost"></a>`authz.row_rule_cost` | schema | error | 400 | 2 | no | — | `rule`, `cost`, `why` |
| <a id="authz.rule_needs_types"></a>`authz.rule_needs_types` | schema | error | 400 | 2 | no | — | `rule`, `field` |
| <a id="authz.view_as_read_only"></a>`authz.view_as_read_only` | policy | error | 403 | 4 | no | — | — |