Return actionable authorization errors
Devuelve errores de autorización accionables
When access is denied, tell the agent which scope or permission is missing and how to obtain it, not just a bare 403.
Why
Opaque permission errors dead-end agents instead of letting them self-correct. The canonical AX framework (agentexperience.ax — Agent Accessibility) requires that agents have a clear path to resolve access issues on behalf of the user. OWASP MCP Top 10 classifies insufficient authorization feedback (MCP07) as a top risk because agents cannot recover from denials they cannot interpret.
Do
Return a machine-readable error with the missing scope.
Don't
Return opaque denials.
Artifact
See the scoped 403 response in AX-SYS-04: include required_scope, your_scopes, and a grant_at URL so the denial is self-correcting.
Citations
- [01]agentexperience.ax — Principles of AX ↗
Agent Accessibility: agents need actionable feedback on denied access — not dead ends — to self-correct and continue on behalf of the user
- [02]OWASP MCP Top 10 — MCP07 ↗
Insufficient authentication and authorization is a top-10 MCP risk; opaque 403 responses prevent agents from recovering