Failure semantics
The difference between denying and blocking, and why no failure results in execution.
An evaluation can end in three ways, and only one of them runs the tool. An agent in Report-only adds a fourth, which runs it too.
DENY means that the policy was evaluated and denied: a relation is missing or a condition was false. It is a normal outcome, recorded with its reason.
WOULD DENY is a DENY of the policy of an agent in Report-only: a tool without a grant, a resource outside the granted ones or a false condition. The tool runs, the caller gets the normal result without a reference code, and the call is recorded with the same reason and path as a DENY. A missing delegation is never a Would deny.
Block means that it was not possible to decide: OpenFGA did not answer, a required fact did not arrive, an expression failed, the configuration changed during evaluation. The agent receives 503. Treating these failures as DENY would hide an infrastructure problem behind "access denied". Treating them as ALLOW would open access exactly when Xokepoint does not know whether it should. A block applies in both modes: Report-only never turns a failure into a call that runs.
A block is also fast. Each OpenFGA call has a 5-second timeout and is not retried, so an OpenFGA outage turns into a 503 at once instead of a call that waits behind retries.
At ingress, each situation has its own response:
| Situation | Response | Executes? |
|---|---|---|
| Invalid token, agent or identity connection | HTTP 401 | No |
| Inconsistent protocol metadata, invalid mapping or arguments | HTTP 400, JSON-RPC error | No |
| Tool outside the approved catalog | HTTP 403 | No |
| Policy denied | HTTP 200, JSON-RPC access denied error | No |
| Policy denied, agent in Report-only | HTTP 200, MCP result | Yes |
| OpenFGA, required fact or evaluation unavailable | HTTP 503 | No |
| MCP server failure after ALLOW | HTTP 502 | Unknown outcome, no retry |
| Success | HTTP 200, MCP result | Yes |
DENY returns as HTTP 200 with a JSON-RPC error because the HTTP call worked and the MCP protocol has a way to say that the tool was denied. The agent gets an answer it understands, without confusing a denial with a network failure. The error carries the Reference code of the denied call and never its reason; the administrator finds the reason by that code (Quick incident).
A 502 after ALLOW is not retried automatically. The tool may have run before the response was lost, and retrying a tool with side effects can perform the action twice.