---
title: "Access rules reference"
description: "Look up Alpacon access decisions by actor and action. Compare defaults, conditions, outcomes, risk signals, plan requirements and refusal codes in one place."
---

> Full documentation index: https://docs.alpacax.com/llms.txt

# Access rules reference

These tables distinguish session admission, account selection, sudo risk and command execution. Unless stated otherwise, defaults describe enforce with no matching workspace rule. Follow each console section’s notice and preview for the checks that apply. An allow at one check does not bypass authentication, scope, account authority or required MFA.

For context, read [How access is decided](/learn/how-access-is-decided/). For authoring and preview steps, use [Access rules](/use/policies/access-rules/).

## Actors and credentials

| Actor or credential | Decision context |
| --- | --- |
| Person | Workspace user identity and roles. Personal API tokens cannot be issued with command-execution or file-transfer scopes; use [service tokens](/use/iam/applications/service-tokens/) for those tasks. |
| AI agent | Declared agent mode through a user or application identity. A self-reported agent name can narrow a rule; the name alone does not establish authority. |
| Service token | Application identity with its own scopes, server reach and command/file pre-approval. Session-less execution is distinct from execution attached to a work session. |
| Alpamon | Managed-server software, not the AI-agent requester mode. A registration credential does not grant an AI agent execution access. |

A session requested with a personal API token, through MCP, by a CLI that declares an agent, or by an unidentified client is put into agent mode.

## Default session admission rules

Session admission has no AI command rating. The requester and the person the session is for are separate role conditions.

| Request | Default admission decision | Additional conditions |
| --- | --- | --- |
| Person with the Superuser role | Allow | Account eligibility and the requested authority still apply. |
| Other person | One approver | Eligible approvers are resolved for the targets. |
| AI agent | A person must approve | An explicit eligible rule allowing agent requesters can admit a session with a stated purpose. No purpose, or attaching sudo policies, still requires a person. |
| Service token attempting to create its own session | Refuse | Use the application's supported automation path; a token does not create a human session. |

For a session spanning several server groups, the decisions are combined so a more restrictive target is not lost. Account rules can make an otherwise allowed request stricter. A rule based only on a self-reported agent name cannot remove the human-approval requirement.

## Default account rules

These are account-classification defaults. Their effect also depends on the deployment's account-policy enforcement and the account's actual reach. The [account selection guide](/use/work-sessions/account-selection/) covers available choices; the table is not a promise that every listed account is selectable.

| Account relationship | Default |
| --- | --- |
| Person's own account, awaiting provisioning | Allow at the account check |
| Person's own bound personal account | Allow at the account check |
| Person's own binding on a system account | Deny |
| Another person's bound account | Deny |
| Application-bound service account | Deny |
| System account | Deny |
| Shared account | One approver |
| Uncategorized account | One approver; review also establishes its classification |

Another person's personal account is a hard refusal in every mode, before rules or advisory can relax anything. It also applies to `sudo`, `su` and `runuser` switching into that account. A user-switch command whose target cannot be determined is refused. For other accounts, Alpacon still checks reach, direct-root settings and whether the session was approved for that account.

## Default sudo rules for people and agents

This table is the in-session sudo **risk decision**, not the session-admission rule or a final grant. The work session must include sudo, the caller must have account authority, and a person must still have the required recent MFA verification.

| AI rating | Person | AI agent |
| --- | --- | --- |
| **Info** | Allow at the risk check | Allow at the risk check |
| **Low** | Allow at the risk check | Allow at the risk check |
| **Medium** | Allow at the risk check | One approver |
| **High** | One approver | One approver |
| **Critical** | Deny by default | Deny by default |
| Unrated | Deny by default | Deny by default |

A workspace rule can change the risk outcome, but a Critical rating cannot resolve to automatic sudo approval. An explicitly reviewed Critical rule can request approval. A person's approval of a held command can cover sudo explicitly visible in that line, including Critical, without overriding scope or account checks or a workspace deny/quorum requirement. Unseen sudo inside a script or wrapper is not covered by that approval.

Terminal sudo has additional authority checks. A matching session policy that substitutes session approval for MFA is considered before one-time approval and ordinary risk/MFA checks. Otherwise, the deployment must support step-up MFA. After the risk check, workspace admins, or owners and managers of a group bound to the server, or people with a matching standing sudo policy, can proceed with MFA; other people need approval and then MFA.

The console separates **Web terminal** from **CLI and API**. Follow the selected section’s notice and **Try it**. When Web terminal shows **The rules under Commands decide sudo here too.**, the sudo rules under **CLI and API** also decide web-terminal sudo; standing authority and MFA checks still apply.

## Default service-token execution rules

Service-token sudo uses a separate risk policy. That policy also decides what happens when AI rejects a token command that has no work session. The token's scopes, account, server reach and pre-approved commands/files remain required.

Under enforce, the token risk policy uses these defaults:

| AI rating supplied to the token risk policy | Default |
| --- | --- |
| INFO, LOW, MEDIUM or HIGH | Allow at this policy check |
| Unrated | Allow at this policy check |
| CRITICAL | Refuse automatic execution; no rule can auto-approve it |

Under enforce, a command explicitly rejected by AI is refused even without a rating. This differs from an unrated result caused by an outage. Under enforce, no risk rule can auto-approve CRITICAL token execution. On Alpacon Cloud under enforce, a command matching a pre-approved ledger entry is still refused at the critical ceiling.

Under enforce, a token sudo policy outcome requiring one or more approvers becomes a refusal. A token command without a work session never waits for approval and is refused at CRITICAL under enforce. Advisory automatically approves token execution at the risk check, including at the critical ceiling.

On Alpacon Cloud in either mode, a command with no matching pre-approved ledger entry is refused, as is a command whose ledger lookup fails. An allow in this table does not promise execution when verification or pre-approval is unavailable.

A command attached to a work session can enter that session's command-approval path; a human approval covering sudo in its visible line can authorize it, subject to remaining restrictions. Do not infer token behavior solely from an AI-agent label.

The workspace must allow sudo. On a default self-hosted deployment, service-token sudo is refused; a risk table alone does not enable it. See [Service tokens](/use/iam/applications/service-tokens/) for credential setup and deployment requirements.

An application/token condition applies regardless of group membership unless a group condition is also included. A group-only restriction does not match an ungrouped server. Test the concrete token and an ungrouped target when reviewing a restriction.

## Default command and file-execution rules

For commands that have passed verification, the built-in command rules are evaluated in this order:

| Matching case | Default |
| --- | --- |
| Exact file execution already cleared by an approver | Allow at the command-policy check |
| Agent command targeting the `agent-approval-required` server group | One approver |
| Agent command with low AI confidence | One approver |
| Other verified command | Allow at the command-policy check |

An approved-file match covers the reviewed bytes, server, account and arguments. A changed file does not inherit it. A matching workspace rule or a departure from the session's purpose can still require review; an approved-file match is not an unconditional bypass.

An ordinary Allow rule does not turn AI rejection into verification. Where human review of an AI rejection is available, a person must decide whether to approve that command. Advisory and service-token handling have the qualifications described on this page.

Commands typed in a web terminal do not use this per-submitted-command policy. Their sudo is checked separately. If a deployment only records command-approval outcomes, its notice says commands are not held for these rules. See [Verified file execution](/use/work-sessions/commands/file-execution/) for the file workflow.

## Matching, order and expiry

Within each approval-rule action, the first matching enabled, unexpired workspace rule wins over built-in defaults. All conditions on that rule must match. A missing value does not match a condition that needs it. When no workspace rule matches, the built-in rules decide.

Set order using the console list; a new rule is added after existing workspace rules for its action. An optional end date must be in the future when saved. A rule without an end date keeps applying until disabled or deleted. Expired and disabled rules do not decide, and deleting a rule leaves the remaining rules and defaults in effect.

This ordering is not one global list for every access check. Hard account refusals, session limits, standing sudo authorization and recent-MFA checks retain their own effect. Session rules naming a declared agent are evaluated separately and can only make the otherwise applicable result stricter. The preview shows the selected path and the rule that decided it.

## Conditions by action

The console exposes a subset of the supported conditions. Existing conditions without an editor field are kept when editing; the presence of a condition in a stored rule does not mean the editor can create it.

| Action | Supported matching conditions | Console authoring |
| --- | --- | --- |
| Opening a session | Requester type, requester global role, assignee global role, server group, declared agent name, target account kind | Requester class/role, agent name, role of the person the session is for, server group and offered account kinds |
| Sudo risk in a session | Risk band, requester type, global role of the person the session is for, server group | Requester class/role, group and rating on the CLI/API surface |
| Service-token execution risk | Risk band, application ID, service-token ID, server group | Application/token selectors are not offered for creating new rules; stored conditions are preserved |
| Submitted command | Requester type, AI confidence band, risk band, approved-file match, server group | Requester class, group and rating; stored confidence and approved-file conditions are preserved |
| Account classification | Account nature and relationship to the person | Classification defaults are separate from the offered session account-kind selector |
| Standing terminal sudo policy | Named people, specific servers and command patterns | People, servers, patterns and optional end date; outcome is allow after MFA |

Requester and assignee roles are global roles, not user-group membership. A server group selects targets. Declared agent names are matched without a version; use the agent requester class to express who acts, and an optional name to narrow it.

The offered session account kinds are own account, shared/system account and root. Existing other-account conditions remain visible as stored, but cannot lift the hard refusal on another person's account. Use [sudo command patterns](/reference/cli/work-session/create/#sudo-command-patterns) for standing policy matching and [token command patterns](/reference/tokens/command-patterns/) for token pre-approval.

## Outcomes and approvers

| Outcome | Meaning |
| --- | --- |
| **Allow** | No approval wait from this rule; other checks still apply. |
| **Allow after MFA** | Standing terminal sudo authorization; recent MFA is still required. |
| **Ask for approval** | The required number of eligible people must approve. A rule can route to server approvers or people with a role. |
| **Block** | This decision refuses the action under enforce. |

The requester may approve by default where they are an eligible approver. A rule can forbid self-approval. If nobody else may approve, the request is refused instead of waiting indefinitely. The preview identifies the eligible approvers and shows when fewer are available than requested. Approver resolution checks role routing first, then group bindings and workspace-wide bindings, then the workspace’s active Superusers. Group and workspace bindings both contribute eligible approvers. If a configured role has no active holder, resolution falls directly back to active Superusers.

Stored multi-stage rules are treated as one approver group using the first stage; they are not a sequential approval workflow. Session-bound MFA substitution and one-time sudo approval are distinct from a standing terminal policy's allow-after-MFA outcome.

## Risk ratings and signals

Risk bands are INFO, LOW, MEDIUM, HIGH and CRITICAL; unrated means no band is available. They are categories, not a published numeric score range. Low AI confidence is a separate condition from a LOW risk band.

| Signal or restriction | Effect and configurability |
| --- | --- |
| `embedded_script` | Signal emitted by command assessment and recorded with the result. |
| Purpose mismatch (`intent_misaligned`) | A separate check requires review when sudo departs from the session’s purpose, even if a workspace Allow rule matches. |
| Command beyond the assessed line (`wrapper_mismatch`) | A separate check requires review when the elevated command is not covered by the assessed line, even if a workspace Allow rule matches. |
| Session sudo risk ceiling and manual sudo approval requirement | Can make an otherwise automatic in-session sudo wait for review. They do not relax a deny or a higher approval requirement. |

The purpose and wrapper checks apply under every sudo rule in enforce, including workspace Allow rules. A custom Allow does not remove them. These checks can only make an automatic result stricter; they do not relax a deny or a higher approval requirement. The console does not offer editable signal lists. Configure its exposed conditions and outcomes instead.

The preview uses a supplied rating and does not run AI, execute a command or create a request/grant. It is a console feature, not a public CLI or MCP evaluation API.

## Advisory and enforce

Enforce applies execution-control outcomes. Advisory records judgments without enforcing the risk decision, including Critical and a session’s manual sudo-approval requirement. Under advisory, session admission, sudo and command execution never create an approval request. Requests for a permission the person does not hold, such as a standing sudo policy, service-token issuance or changes, or username or account approval, still go to approvers as usual. New sessions do not wait for execution-control approval, but account denies still apply.

Authentication, credential permissions, session scope, account denies, token access rules and inline-credential checks remain. They still refuse actions they do not permit. Terminal sudo with no standing authority or matching policy is refused with `sudo_no_authority`. Advisory is not universal sudo permission.

Switching posture does not auto-approve pending requests. They retain their existing expiry rules. A new request uses the current posture. See [Server access](/use/policies/server-access/) for workspace configuration.

## Plan and permission availability

| Capability | Requirement |
| --- | --- |
| View the rule list | Workspace admin with `approval_policy:read`, or Superuser; console access on every deployment |
| Create/update/delete approval rules | Corresponding `approval_policy` permission; console only |
| Create/update/delete standing sudo policies | Corresponding `sudo_policy` permission and target authority |
| Approval rule without matching conditions | Available on Free |
| Conditions, forbidding self-approval, or routing approvers by role | Essentials or Enterprise; a stored rule can still be disabled on Free |
| Select more than one approver in the editor | Enterprise |
| Preview another concrete person or service token | Paid plan; subject-class previews remain available on Free |
| Standing sudo policy | Paid plan; session-bound policy creation is treated separately |
| Enable **Allow approval to take the place of MFA** when managing a sudo policy in the console | Enterprise and a valid work-session binding; session requests have separate authoring requirements |

MFA controls also depend on the deployment's identity provider and supported settings. A disabled control is not permission to bypass the requirement. Current deployment notices and the preview determine which rule surface is effective.

## Related error codes

Use the serialized lowercase code and, when supplied, the refusal's `gate`, `missing` and approval reference. Read the English `hint` for guidance; programs should use the structured fields. Do not infer a pending approval request from the code alone.

| Code | Cause and recovery |
| --- | --- |
| [`work_session_scope_not_allowed`](/reference/error-messages/#work_session_scope_not_allowed) | The session lacks the requested feature; request that scope, including sudo when needed. |
| [`work_session_account_not_approved`](/reference/error-messages/#work_session_account_not_approved) | The agent session does not cover that account; use its approved account or request a session for the needed account. |
| [`work_session_agent_not_allowed`](/reference/error-messages/#work_session_agent_not_allowed) | The workspace policy does not allow this agent; use an allowed agent. |
| [`work_session_sudo_bypass_console_only`](/reference/error-messages/#work_session_sudo_bypass_console_only) | Adding session sudo that bypasses MFA requires the web console; make the change there. |
| [`sudo_risk_denied`](/reference/error-messages/#sudo_risk_denied) | Risk control refused the command; change the command or review the applicable access rule before retrying. |
| [`sudo_presence_required`](/reference/error-messages/#sudo_presence_required) | Sudo needs fresh MFA; complete a supported verification, then retry. |
| [`sudo_step_up_unavailable`](/reference/error-messages/#sudo_step_up_unavailable) | The required MFA check is unavailable here; only sudo that does not require that check can proceed. |
| [`sudo_approval_required`](/reference/error-messages/#sudo_approval_required) | Sudo requires approval; check the reported gate and request state, and retry only when authorized. |
| [`sudo_intent_deviation`](/reference/error-messages/#sudo_intent_deviation) | The command departs from the session purpose; check any request state, or request a session for the changed work. |
| [`sudo_approval_pending`](/reference/error-messages/#sudo_approval_pending) | Approval and identity verification did not both finish before the wait ended; check the referenced request before retrying. |
| [`sudo_approval_already_waiting`](/reference/error-messages/#sudo_approval_already_waiting) | The same command is waiting in another terminal; wait there or stop that wait before retrying. |
| [`sudo_approval_rejected`](/reference/error-messages/#sudo_approval_rejected) | Approval was rejected, withdrawn or expired; read the request state before making a new attempt. |
| [`sudo_no_authority`](/reference/error-messages/#sudo_no_authority) | No standing authority covers the command; check `gate` and any request state. A `sudo` gate means this attempt is not waiting, including under advisory. |
| [`sudo_command_not_authorized`](/reference/error-messages/#sudo_command_not_authorized) | The sudo cannot be traced to a person; run it as a person's command. |
| [`sudo_policy_mfa_required`](/reference/error-messages/#sudo_policy_mfa_required) | The policy needs MFA that a non-interactive command cannot supply; use an interactive terminal. |
| [`sudo_no_worksession_policy`](/reference/error-messages/#sudo_no_worksession_policy) | No session sudo policy covers the command; use a session with matching sudo patterns, requesting approval for changes when needed. |
| [`sudo_target_other_person`](/reference/error-messages/#sudo_target_other_person) | The command targets another person's account, which is always refused; use your own or a shared account. |
| [`sudo_target_unparsed`](/reference/error-messages/#sudo_target_unparsed) | The target account could not be determined; spell it out explicitly and retry. |
| [`sudo_no_accountable_actor`](/reference/error-messages/#sudo_no_accountable_actor) | No active person is accountable for this sudo; use a session belonging to a person with an active account. |
| [`sudo_account_bound_to_application`](/reference/error-messages/#sudo_account_bound_to_application) | An application-bound account cannot elevate from a terminal; use command execution instead. |
| [`sudo_system_user_not_found`](/reference/error-messages/#sudo_system_user_not_found) | Alpacon does not know the server account; connect with an account it manages and retry. |
| [`sudo_session_missing`](/reference/error-messages/#sudo_session_missing) | The sudo has no open Alpacon session; run it inside an approved work session or an interactive Websh session. |
| [`sudo_command_too_long`](/reference/error-messages/#sudo_command_too_long) | The command is too long to record; shorten it and retry. |
| [`sudo_policy_bypass_agent_session_needs_approval`](/reference/error-messages/#sudo_policy_bypass_agent_session_needs_approval) | Adding a sudo policy with **Allow approval to take the place of MFA** to an agent session needs human approval; request it as a session change. |
| [`sudo_policy_bypass_agent_session_needs_presence`](/reference/error-messages/#sudo_policy_bypass_agent_session_needs_presence) | Changing an agent session's sudo policy with **Allow approval to take the place of MFA** needs fresh MFA; verify and retry. |
| [`sudo_verify_credential_cannot_prove_mfa`](/reference/error-messages/#sudo_verify_credential_cannot_prove_mfa) | This credential cannot prove MFA; verify from a console or CLI sign-in. |
| [`sudo_policy_console_only`](/reference/error-messages/#sudo_policy_console_only) | Creating or widening a sudo policy requires the web console; make the change there. |
| [`workspace_sudo_with_mfa_disabled`](/reference/error-messages/#workspace_sudo_with_mfa_disabled) | Workspace sudo is turned off; execution requires the workspace settings to allow it. |
| [`workspace_block_local_sudo_step_up_unavailable`](/reference/error-messages/#workspace_block_local_sudo_step_up_unavailable) | This workspace cannot perform sudo MFA; local sudo cannot be blocked here. |
| [`workspace_sudo_with_mfa_step_up_unavailable`](/reference/error-messages/#workspace_sudo_with_mfa_step_up_unavailable) | This workspace cannot perform sudo MFA; this setting cannot be changed here. |
| [`approval_no_other_approver`](/reference/error-messages/#approval_no_other_approver) | Self-approval is forbidden and nobody else is eligible; review approver assignments before requesting again. |
| [`approval_requester_may_not_approve`](/reference/error-messages/#approval_requester_may_not_approve) | The requester cannot decide their own request; another eligible person must decide. |
| [`approval_request_not_approver`](/reference/error-messages/#approval_request_not_approver) | Your account cannot decide this request; use an eligible approver account. |
| [`approval_request_not_requester`](/reference/error-messages/#approval_request_not_requester) | Your account did not raise this request and cannot cancel it; cancellation must come from its requester. |
| `agent_credential_not_accepted` | A managed-server agent credential cannot do this; use a person or an API token with the required access. |
| [`auth_mfa_required`](/reference/error-messages/#auth_mfa_required) | The action needs recent MFA; complete MFA and retry. |
| [`auth_mfa_requires_human_principal`](/reference/error-messages/#auth_mfa_requires_human_principal) | Only a person can provide the required MFA; sign in as a person and retry. |
| [`auth_interactive_channel_requires_presence`](/reference/error-messages/#auth_interactive_channel_requires_presence) | This credential cannot open an interactive session; sign in to the console or CLI. |
| [`api_token_scope_action_unresolved`](/reference/error-messages/#api_token_scope_action_unresolved) | No token scope covers this action; use a console sign-in. |
| [`api_token_scope_missing`](/reference/error-messages/#api_token_scope_missing) | The token lacks a required scope; use a token that holds it. |
| [`api_token_acl_not_allowed`](/reference/error-messages/#api_token_acl_not_allowed) | Check `server_reach`, `command_acl` or `file_acl` for missing server, command or transfer permission; use an authorized target or operation. |
| [`command_acl_moved`](/reference/error-messages/#command_acl_moved) | Command pre-approval is managed in the AI command ledger; use its console controls. |
| [`local_access_principal_not_supported`](/reference/error-messages/#local_access_principal_not_supported) | This action requires a person signed in to the console; a token cannot perform it. |
| [`local_access_claim_not_maintainer`](/reference/error-messages/#local_access_claim_not_maintainer) | You do not maintain the account's application; only a maintainer can claim this login as automation. |
| [`rbac_permission_required`](/reference/error-messages/#rbac_permission_required) | Your roles lack this action; check that the assigned roles grant it. |
| [`rbac_object_permission_required`](/reference/error-messages/#rbac_object_permission_required) | Your roles do not cover this item; check role access to the target. |
| [`rbac_application_update_required`](/reference/error-messages/#rbac_application_update_required) | Your roles cannot update every selected application; check permissions for each application. |
| [`permission_denied`](/reference/error-messages/#permission_denied) | The account or credential lacks permission; check its access before retrying. |
| [`user_no_permission`](/reference/error-messages/#user_no_permission) | Your account lacks permission for this action; check its assigned roles. |
| [`api_not_for_alpacon`](/reference/error-messages/#api_not_for_alpacon) | A managed-server agent credential cannot make this request; use a supported user credential. |
| [`api_rate_limited`](/reference/error-messages/#api_rate_limited) | Too many requests were made; wait before retrying. |
| [`service_token_application_forbidden`](/reference/error-messages/#service_token_application_forbidden) | Your roles cannot issue or change this application's tokens; check application authority. |
| [`service_token_break_glass_unauthorized`](/reference/error-messages/#service_token_break_glass_unauthorized) | Only a Superuser can activate break-glass; check the acting account's role. |
| [`workspace_security_settings_console_only`](/reference/error-messages/#workspace_security_settings_console_only) | Weakening workspace MFA settings requires the web console; make the change there. |
| [`workspace_execution_control_console_only`](/reference/error-messages/#workspace_execution_control_console_only) | Loosening execution control requires the web console; make the change there. |
| [`workspace_execution_control_mode_presence_required`](/reference/error-messages/#workspace_execution_control_mode_presence_required) | Changing execution control requires fresh MFA; verify and retry. |
| [`workspace_execution_control_mode_superuser_required`](/reference/error-messages/#workspace_execution_control_mode_superuser_required) | Changing execution control requires a Superuser; check the acting account's role. |
| [`workspace_plan_update_required`](/reference/error-messages/#workspace_plan_update_required) | The feature is not included in the plan; use an included feature or change plans. |
| [`workspace_enterprise_plan_required`](/reference/error-messages/#workspace_enterprise_plan_required) | The feature requires Enterprise; use an included feature or change plans. |
| [`access_rules_admin_only`](/reference/error-messages/#access_rules_admin_only) | The account cannot view these rules or evaluate this subject; use an authorized workspace admin. |
| [`access_rules_console_only`](/reference/error-messages/#access_rules_console_only) | Access rules and previews are console-only; use the web console. |
| [`approval_policy_console_only`](/reference/error-messages/#approval_policy_console_only) | Approval rules can be read and changed only in the console; use it to manage them. |
| [`group_agent_approval_console_only`](/reference/error-messages/#group_agent_approval_console_only) | Changing a group's agent-approval requirement requires the console; make the change there. |
| [`group_agent_approval_policy_authority_required`](/reference/error-messages/#group_agent_approval_policy_authority_required) | Changing the group's agent-approval requirement needs approval-policy authority; check the acting account's permissions. |
| [`access_rules_subject_unknown`](/reference/error-messages/#access_rules_subject_unknown) | The preview subject is unknown or inaccessible; select an available subject. |
| [`approval_policy_valid_until_past`](/reference/error-messages/#approval_policy_valid_until_past) | The rule's end date is not in the future; choose a future date. |
| [`approval_policy_critical_auto_forbidden`](/reference/error-messages/#approval_policy_critical_auto_forbidden) | The rule would auto-approve CRITICAL execution; choose refusal or an explicit review outcome where supported. |
| [`approval_policy_other_person_account_locked`](/reference/error-messages/#approval_policy_other_person_account_locked) | The rule would relax another person's account restriction; keep that account denied. |
| [`approval_policy_agent_auto_forbidden`](/reference/error-messages/#approval_policy_agent_auto_forbidden) | An agent name alone cannot authorize automatic admission; retain human approval or explicitly select agent requesters for an intended Allow rule. |
| [`approval_policy_requester_type_required`](/reference/error-messages/#approval_policy_requester_type_required) | A role condition lacks a requester type; select the intended requester class too. |
| [`approval_policy_request_type_unknown`](/reference/error-messages/#approval_policy_request_type_unknown) | The action type is unsupported; choose a supported action in the editor. |
| [`approval_policy_condition_key_unsupported`](/reference/error-messages/#approval_policy_condition_key_unsupported) | A condition does not apply to this action; use the conditions offered for it. |
| [`approval_policy_requester_may_approve_unsupported`](/reference/error-messages/#approval_policy_requester_may_approve_unsupported) | This action cannot use the self-approval restriction; remove that restriction for this action. |
| [`approval_policy_stages_shape_invalid`](/reference/error-messages/#approval_policy_stages_shape_invalid) | The approver configuration is invalid; set a valid approver count and routing in the editor. |
| [`approval_policy_stages_lane_mismatch`](/reference/error-messages/#approval_policy_stages_lane_mismatch) | The approver configuration does not fit the outcome; align the outcome and approver settings. |
| [`approval_policy_stage_role_unknown`](/reference/error-messages/#approval_policy_stage_role_unknown) | The approver role does not exist; select an existing role. |
| [`approval_policy_reorder_mismatch`](/reference/error-messages/#approval_policy_reorder_mismatch) | The order does not match the current rule list; reload the list and reorder it again. |
| [`approval_missing_metadata`](/reference/error-messages/#approval_missing_metadata) | The approval request lacks required information; submit a new request with the complete details. |
| [`approval_request_already_decided`](/reference/error-messages/#approval_request_already_decided) | You already decided on this request; check its current state instead of voting again. |
| [`approval_request_already_reviewed_or_cancelled`](/reference/error-messages/#approval_request_already_reviewed_or_cancelled) | The request has already been reviewed or cancelled; check the result before making a new request. |
| [`approval_request_expired`](/reference/error-messages/#approval_request_expired) | The approval request expired; submit a new request if the access is still needed. |
| [`approval_request_not_allowed`](/reference/error-messages/#approval_request_not_allowed) | This approval request is not allowed; check whether the requested action supports approval. |
| [`approval_request_status_invalid`](/reference/error-messages/#approval_request_status_invalid) | The request's current status does not allow this action; reload it and check its state. |
| [`approval_request_type_invalid`](/reference/error-messages/#approval_request_type_invalid) | The approval request type is invalid; use the supported request flow for the permission you need. |
| [`approval_superuser_approve_required`](/reference/error-messages/#approval_superuser_approve_required) | The username needs Superuser approval and a request has been sent; wait for its decision. |
| [`sudo_grant_not_pending`](/reference/error-messages/#sudo_grant_not_pending) | The sudo authorization is no longer waiting for MFA; check its state before starting another attempt. |
| [`sudo_iam_user_not_found`](/reference/error-messages/#sudo_iam_user_not_found) | The server account is not linked to an Alpacon user; ask an administrator to link it before using sudo. |
| [`sudo_mfa_failed`](/reference/error-messages/#sudo_mfa_failed) | The sudo MFA check failed; verify with your configured method, then run the command again. |
| [`sudo_policy_bypass_requires_worksession`](/reference/error-messages/#sudo_policy_bypass_requires_worksession) | Approval can replace sudo MFA only within an active work session; bind the policy to one. |
| [`sudo_policy_bypass_worksession_unusable`](/reference/error-messages/#sudo_policy_bypass_worksession_unusable) | The bound session has ended and cannot authorize MFA substitution; request a policy bound to a usable session. |
| [`sudo_policy_changed_since_request`](/reference/error-messages/#sudo_policy_changed_since_request) | The sudo policies changed after this request, so it cannot be approved; ask the requester to request it again. |
| [`sudo_policy_command_not_allowed`](/reference/error-messages/#sudo_policy_command_not_allowed) | No sudo policy covers this command; request a policy that covers the needed command. |
| [`sudo_policy_expired`](/reference/error-messages/#sudo_policy_expired) | The sudo policy's validity period ended; request a new policy before retrying. |
| [`sudo_policy_rebound`](/reference/error-messages/#sudo_policy_rebound) | The policy's work session changed while you were editing; reload the page before retrying. |
| [`sudo_policy_request_bypass_mfa_not_allowed`](/reference/error-messages/#sudo_policy_request_bypass_mfa_not_allowed) | A standalone sudo request cannot replace MFA with approval; request the policy as part of a work session. |
| [`sudo_policy_request_metadata_corrupted`](/reference/error-messages/#sudo_policy_request_metadata_corrupted) | The sudo request's approval information is invalid and cannot be approved; submit a new request. |
| [`sudo_policy_request_user_not_self`](/reference/error-messages/#sudo_policy_request_user_not_self) | You cannot request this sudo policy for someone else; request access for yourself. |
| [`sudo_policy_required`](/reference/error-messages/#sudo_policy_required) | No sudo policy covers this request; request one for the required server and account. |
| [`sudo_response_timeout`](/reference/error-messages/#sudo_response_timeout) | No decision arrived before the sudo request timed out; run the command again to make a new request. |
| [`sudo_system_error`](/reference/error-messages/#sudo_system_error) | Sudo approval could not be processed; wait briefly, then retry. |
| [`sudo_websocket_unavailable`](/reference/error-messages/#sudo_websocket_unavailable) | The live connection dropped before the sudo request could be delivered; reconnect and retry. |
| [`target_account_other_person`](/reference/error-messages/#target_account_other_person) | The account belongs to another person on at least one target server and is refused in every mode; choose your own or a shared account. |
| [`work_session_admission_denied`](/reference/error-messages/#work_session_admission_denied) | The workspace policy refuses a session on these servers; ask an administrator to review the applicable rule. |
| [`work_session_agent_session_required`](/reference/error-messages/#work_session_agent_session_required) | An agent cannot use a person's session; open an agent session instead. |
| [`work_session_assignee_mismatch`](/reference/error-messages/#work_session_assignee_mismatch) | You are not the session's assignee, so its access does not apply to you; start your own session or request reassignment. |
| [`work_session_assignee_not_allowed`](/reference/error-messages/#work_session_assignee_not_allowed) | You cannot assign the session to this person or change its assignee; use an allowed assignee or request an administrator's help. |
| `work_session_cluster_not_allowed` | The session does not cover this cluster; use its approved cluster or request a session for the needed one. |
| [`work_session_expired`](/reference/error-messages/#work_session_expired) | The session expired and no longer grants access; start a new session. |
| [`work_session_expires_exceeds_max_ttl`](/reference/error-messages/#work_session_expires_exceeds_max_ttl) | The requested session exceeds the allowed duration; shorten it to the permitted limit. |
| [`work_session_extension_already_pending`](/reference/error-messages/#work_session_extension_already_pending) | An extension request is awaiting review; wait for its decision or cancel it before requesting another extension. |
| [`work_session_mod_already_pending`](/reference/error-messages/#work_session_mod_already_pending) | A session change is already awaiting review; wait for it or cancel it before requesting another change. |
| [`work_session_not_active`](/reference/error-messages/#work_session_not_active) | The action requires an active session; start an approved session before retrying. |
| [`work_session_not_approved`](/reference/error-messages/#work_session_not_approved) | The session is not approved, or was rejected or cancelled; check its status before trying to start it. |
| [`work_session_not_assignee`](/reference/error-messages/#work_session_not_assignee) | Only the session's assignee may perform this action; use the assignee's signed-in account. |
| [`work_session_not_found`](/reference/error-messages/#work_session_not_found) | The work session could not be found; check the session you selected and use an available one. |
| [`work_session_not_modifiable`](/reference/error-messages/#work_session_not_modifiable) | The session's state no longer permits changes; request a new session if different access is needed. |
| [`work_session_not_pending`](/reference/error-messages/#work_session_not_pending) | The session is not awaiting approval for this action; check its current state before editing or deciding its request. |
| [`work_session_not_started`](/reference/error-messages/#work_session_not_started) | The session's start time has not arrived, so it cannot be extended; wait until it starts. |
| [`work_session_not_usable`](/reference/error-messages/#work_session_not_usable) | The session cannot be used in its current state; check its status and use an approved, usable session. |
| [`work_session_principal_not_supported`](/reference/error-messages/#work_session_principal_not_supported) | A service token cannot create a work session; use the application's token execution path or sign in as a person to request a session. |
| [`work_session_required`](/reference/error-messages/#work_session_required) | This action requires a work session; start an approved session and attach the action to it. |
| [`work_session_server_not_allowed`](/reference/error-messages/#work_session_server_not_allowed) | A target server is outside the session; choose an approved server or request a session change covering the target. |
| [`work_session_sudo_loosen_forbidden`](/reference/error-messages/#work_session_sudo_loosen_forbidden) | An approver cannot loosen the requested sudo restrictions; keep them or make them stricter. |
| [`work_session_sudo_policy_id_not_bound`](/reference/error-messages/#work_session_sudo_policy_id_not_bound) | The selected sudo policy does not belong to this session; reload and select one bound to it. |
| [`work_session_sudo_policy_user_not_assigned`](/reference/error-messages/#work_session_sudo_policy_user_not_assigned) | You cannot attach a sudo policy for someone other than the session assignee; select the assignee. |
| [`work_session_sudo_policy_without_scope`](/reference/error-messages/#work_session_sudo_policy_without_scope) | Sudo policies require sudo in the session's scope; request that scope before adding policies. |
| [`work_session_target_account_absent`](/reference/error-messages/#work_session_target_account_absent) | The account is absent on a selected server and will not be created there; remove that server or choose another account. |
| [`work_session_target_account_clear_forbidden`](/reference/error-messages/#work_session_target_account_clear_forbidden) | A declared account cannot be cleared; keep it or request an allowed account change. |
| [`work_session_target_account_denied`](/reference/error-messages/#work_session_target_account_denied) | The account is not allowed on at least one selected server when the request is approved or changed; choose another account or ask an administrator to review it. |
| [`work_session_target_account_not_applicable`](/reference/error-messages/#work_session_target_account_not_applicable) | This session cannot declare or adjust its connect-as account here; use the account controls applicable to its credential and session. |
| [`work_session_target_account_not_narrower`](/reference/error-messages/#work_session_target_account_not_narrower) | An approver's replacement account would widen the requested access; keep the account or select one that narrows access. |
| [`work_session_target_account_not_reachable`](/reference/error-messages/#work_session_target_account_not_reachable) | The session holder's roles do not permit the account on a selected server; check that server's account access or choose an accessible account. |
| [`work_session_target_account_unavailable`](/reference/error-messages/#work_session_target_account_unavailable) | The account exists but cannot be used on a selected server; choose an eligible account or have its binding and login availability reviewed. |
| [`work_session_window_not_narrower`](/reference/error-messages/#work_session_window_not_narrower) | An approver cannot lengthen the requested session window; keep or shorten it, and use an extension request for more time. |
| [`workspace_execution_control_mode_step_up_unavailable`](/reference/error-messages/#workspace_execution_control_mode_step_up_unavailable) | This deployment cannot perform the required identity check, so execution-control mode cannot be changed here; keep the current mode. |
| [`workspace_sudo_mfa_recheck_source_mismatch`](/reference/error-messages/#workspace_sudo_mfa_recheck_source_mismatch) | The setting you edited no longer controls sudo MFA here; refresh the page and edit the current setting. |
| [`workspace_sudo_with_mfa_required_for_block_local`](/reference/error-messages/#workspace_sudo_with_mfa_required_for_block_local) | Blocking local sudo requires sudo with MFA; enable sudo with MFA before blocking local sudo. |

For recovery steps, use [PAM and sudo issues](/use/work-sessions/terminal/troubleshoot-sudo/) or [Command troubleshooting](/use/work-sessions/commands/troubleshooting/). Error messages are maintained in the generated catalog; these tables explain which decision to investigate.

Source: https://docs.alpacax.com/reference/access-rules/