The codes, and what they cost you
Any vendor will tell you what their system does. Ask one what it declines to do, and watch the answer get vague.
Here is ours, with the machine codes. Paste one into a ticket and quote it back at us.
What it refuses, and what happens when it does
GATE_DISAGREEMENT
Two models did not agree
Two models were asked to derive the same answer and did not agree.
- What happens
- Nothing is released, and no effect is applied.
- What we do not do
- Quietly pick one of the two.
A system that picked one would be more useful on the day and indefensible in the year.
UC040
SCOPE_PREDICATE_MISSING
We could not tell whose data this is
The session did not resolve to one organisation, one owner and — where it applies — one business unit, so the surface refused rather than guessed.
- What happens
- The read does not run, and the page says which part of the scope was missing.
- What we do not do
- Fill the gap with a placeholder identifier, or widen the read to the organisation and hope.
Signing in again will not clear this one, and telling you to would send you round a loop that cannot end. It means the session carries no workspace.
UC010
NOT_SIGNED_IN
No session, so no read
There is no session at all, so there is nobody for the record to be scoped to.
- What happens
- You are sent to sign in, and the surface stays empty behind it.
- What we do not do
- Render a demo tenant’s data to fill the space while you are signed out.
SESSION_REJECTED
A session that no longer verifies
A session was presented and the issuer refused it — it expired, or it was signed elsewhere.
- What happens
- You sign in again, and the surface says which of the two it was.
- What we do not do
- Collapse this into "you are not signed in". They have different remedies, so they keep different codes.
BFF_UNREACHABLE
We could not reach the record store
The question never got asked. Nothing was refused and nothing was found — the service that holds the record did not answer.
- What happens
- The surface says the system does not know, and offers the retry.
- What we do not do
- Show you an empty list as though it were an answer, or render a transport fault as though your access had been denied.
UC100
CAPABILITY_NOT_BUILT
You asked for something we have not built
The capability is declared and not built, and the surface says so in those words instead of showing you an empty box.
- What happens
- A 501 with the code, naming precisely what is missing.
- What we do not do
- Render an empty chart, an empty axis or a zero and let you read it as a result.
An empty watcher renders as an empty watcher. The standing register carries the full list.
And three things we will not build
We will not infer personality or emotion to price, underwrite or decide a claim. Not as an option, not behind a flag.
The record certifies the absence rather than asserting it (UC097). The lineage and context gates that would enforce the boundary end to end are on the standing register as designed and not built, and that belongs in the same breath as the promise.
We will not let a model determine liability, coverage or settlement on its own.
An adverse ruling carries a named human who made it, at a durable waitpoint, with the reasons captured as a required field (UC028, UC094).
We will not charge you as a percentage of your book.
The published ladder counts artefacts — models, signers, certificates, regimes — and the pricing page carries the falsifier for each line rather than a rate on your premium.
Where you can watch one happen
A list of refusals is still only a list. The step where the work actually stops is plate 05 of a working day — a control blocks the submission, names itself, and sends the broker a request with what would clear it. And where this sits is the argument for why a layer can stop something a panel cannot.