Deny codes

const result = await client.evaluate({ /* ... */ });

// Pin to the canonical lowercase 4-value field. The legacy
// `decision` field returns "ALLOW" / "DENY" only and collapses
// hold/escalate into "DENY" — read decision_canonical instead.
if (result.decision_canonical === "allow") {
  // proceed
} else {
  switch (result.deny_code) {
    case "INSUFFICIENT_APPROVALS":
    case "INSUFFICIENT_ROLE_APPROVALS":
      // collect more approvals, resubmit
      break;
    case "FROZEN":
      // surface "inside freeze window" to the caller
      break;
    case "AMBIGUOUS_POLICY":
      // alert ops — policy needs a tie-break
      break;
    case "SNAPSHOT_REQUIRED":
      // add a top-level state_snapshot to the request and retry
      break;
    case "ACTOR_HELD":
    case "ROLE_HELD":
    case "RISK_HOLD":
      // surface "waiting for review" UI
      break;
    // Deploy gate codes
    case "DENY_AUTHORITY":
      // actor's role is not approved — surface role requirement
      break;
    case "DENY_ENVIRONMENT":
      // permit environment mismatch — check context.environment
      break;
    case "VERIFY_FAILED":
      // no verified permit — call verify-permit first
      break;
    case "PERMIT_EXPIRED":
      // permit TTL exceeded — re-issue
      break;
    case "ESCALATE_REQUIRED":
      // inconsistent state — route to human reviewer queue
      break;
    case "DENY_POLICY":
    default:
      // generic "denied — see audit trail" surface
  }
}