# AX-SYS-06: Return actionable authorization errors

> Access and identity · foundational · AX-SYS-06

When access is denied, tell the agent which scope or permission is missing and how to obtain it, not just a bare 403.

## Why

Opaque permission errors dead-end agents instead of letting them self-correct. The canonical AX framework (agentexperience.ax — Agent Accessibility) requires that agents have a clear path to resolve access issues on behalf of the user. OWASP MCP Top 10 classifies insufficient authorization feedback (MCP07) as a top risk because agents cannot recover from denials they cannot interpret.

## Do

Return a machine-readable error with the missing scope.

## Don't

Return opaque denials.

## Artifact

See the scoped 403 response in [AX-SYS-04](ax-sys-04-authenticate-without-human-only-gates.mdx): include `required_scope`, `your_scopes`, and a `grant_at` URL so the denial is self-correcting.

## Citations

1. [agentexperience.ax — Principles of AX](https://agentexperience.ax/concepts/principles-of-ax/) — Agent Accessibility: agents need actionable feedback on denied access — not dead ends — to self-correct and continue on behalf of the user
2. [OWASP MCP Top 10 — MCP07](https://owasp.org/www-project-mcp-top-10/) — Insufficient authentication and authorization is a top-10 MCP risk; opaque 403 responses prevent agents from recovering

---
Source: Agent Experience Principles (axprinciples.com)