Documentation
Common Errors by ActionKind
Common Errors by ActionKind
This page is generated from the managed policy catalog. Use it to find likely causes of WARN/BLOCK for each action.
| ActionKind | Required context | Common BLOCK causes | Common WARN causes |
|---|---|---|---|
| messaging.send BLOCK: 8 · WARN: 3 | account_id, actor_user_id, ai_output, compliance_context, idempotency_key, message_body, payload_preview, payload_schema, purpose, recent_duplicate_count, recipient_count, recipient_source, request_id, system_instructions, template_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block prompt injection and instruction override attempts. | Warn when output contains PII and requires redaction/minimization before sharing/exporting. · Warn on regulated claims (legal/medical/financial) unless using approved templates/disclaimers. |
| data.export BLOCK: 7 · WARN: 1 | account_id, actor_user_id, ai_output, compliance_context, idempotency_key, purpose, request_id, resource_tenant_id, system_instructions, tenant_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block prompt injection and instruction override attempts. | Warn when output contains PII and requires redaction/minimization before sharing/exporting. |
| money.refund BLOCK: 6 · WARN: 3 | account_id, actor_user_id, ai_output, amount_usd, authz_decision, case_id, idempotency_key, invoice_id, payload_preview, payload_schema, recent_actions_count, recent_duplicate_count, request_id, session_user_id, system_instructions, time_window_minutes, transaction_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block prompt injection and instruction override attempts. | Warn and require approval for high-value refunds/credits. · Warn when financial actions exceed safe velocity thresholds. |
| workflow.execute BLOCK: 5 · WARN: 2 | account_id, actor_user_id, ai_output, idempotency_key, log_payload_preview, payload_preview, payload_schema, recent_duplicate_count, request_id, session_user_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block prompt injection and instruction override attempts. | Warn if logs attempt to store sensitive data or raw secrets. · Warn when structured tool args are invalid/missing required fields. |
| data.share BLOCK: 5 · WARN: 1 | account_id, actor_user_id, ai_output, compliance_context, idempotency_key, purpose, request_id, resource_tenant_id, system_instructions, tenant_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block cross-tenant access or mutations. | Warn when output contains PII and requires redaction/minimization before sharing/exporting. |
| admin.access BLOCK: 5 · WARN: 0 | account_id, actor_user_id, authz_decision, current_roles, idempotency_key, request_id, requested_change, resource_tenant_id, session_user_id, system_instructions, tenant_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block cross-tenant access or mutations. | — |
| data.write BLOCK: 4 · WARN: 1 | account_id, actor_user_id, idempotency_key, payload_preview, payload_schema, recent_duplicate_count, request_id, resource_tenant_id, session_user_id, system_instructions, tenant_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block cross-tenant access or mutations. | Warn when structured tool args are invalid/missing required fields. |
| money.payout BLOCK: 4 · WARN: 1 | account_id, actor_user_id, amount_usd, authz_decision, case_id, destination_id, destination_verified, idempotency_key, invoice_id, recent_actions_count, request_id, system_instructions, time_window_minutes, transaction_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block refunds/credits/payouts without verified evidence and authorization. | Warn when financial actions exceed safe velocity thresholds. |
| messaging.webhook BLOCK: 4 · WARN: 0 | account_id, actor_user_id, ai_output, idempotency_key, message_body, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block exfiltration of secrets, API keys, tokens, private certificates, passwords. | — |
| data.purge BLOCK: 3 · WARN: 1 | account_id, actor_user_id, blast_radius_estimate, change_ticket, idempotency_key, recovery_plan, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block purges with large blast radius or irreversible impact. | Warn on destructive deletes without a ticket and recovery plan. |
| workflow.modify BLOCK: 3 · WARN: 1 | account_id, actor_user_id, ai_output, idempotency_key, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block prompt injection and instruction override attempts. | Warn when output attempts to rewrite safety rules/policies or reduce constraints. |
| identity.auth_change BLOCK: 3 · WARN: 0 | account_id, actor_user_id, allowed_scopes, authz_decision, connector_id, current_roles, idempotency_key, request_id, requested_change, requested_scopes, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block privilege escalation and unauthorized role changes. | — |
| integrations.scope_change BLOCK: 3 · WARN: 0 | account_id, actor_user_id, allowed_scopes, authz_decision, connector_id, current_roles, idempotency_key, request_id, requested_change, requested_scopes, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block privilege escalation and unauthorized role changes. | — |
| money.credit BLOCK: 2 · WARN: 2 | account_id, actor_user_id, amount_usd, authz_decision, case_id, idempotency_key, invoice_id, recent_actions_count, request_id, system_instructions, time_window_minutes, transaction_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block refunds/credits/payouts without verified evidence and authorization. | Warn and require approval for high-value refunds/credits. · Warn when financial actions exceed safe velocity thresholds. |
| data.delete BLOCK: 2 · WARN: 1 | account_id, actor_user_id, blast_radius_estimate, change_ticket, idempotency_key, recovery_plan, request_id, resource_tenant_id, system_instructions, tenant_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block cross-tenant access or mutations. | Warn on destructive deletes without a ticket and recovery plan. |
| money.move BLOCK: 2 · WARN: 1 | account_id, actor_user_id, amount_usd, destination_id, destination_verified, idempotency_key, recent_actions_count, request_id, system_instructions, time_window_minutes, user_input, workflow, workflowName | Block when required integration context is missing. · Block payouts to unverified or new destinations. | Warn when financial actions exceed safe velocity thresholds. |
| billing.change BLOCK: 2 · WARN: 0 | account_id, actor_user_id, authz_decision, case_id, idempotency_key, invoice_id, request_id, system_instructions, transaction_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block refunds/credits/payouts without verified evidence and authorization. | — |
| data.read BLOCK: 2 · WARN: 0 | account_id, actor_user_id, idempotency_key, request_id, resource_tenant_id, system_instructions, tenant_id, user_input, workflow, workflowName | Block when required integration context is missing. · Block cross-tenant access or mutations. | — |
| identity.role_change BLOCK: 2 · WARN: 0 | account_id, actor_user_id, authz_decision, current_roles, idempotency_key, request_id, requested_change, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block privilege escalation and unauthorized role changes. | — |
| messaging.broadcast BLOCK: 2 · WARN: 0 | account_id, actor_user_id, idempotency_key, message_body, recipient_count, recipient_source, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. · Block spammy bulk outbound messaging and unsolicited broadcasts. | — |
| integrations.connect BLOCK: 1 · WARN: 1 | account_id, actor_user_id, connector_id, idempotency_key, request_id, requested_scopes, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. | Warn when connecting a new integration without review. |
| billing.cancel BLOCK: 1 · WARN: 0 | account_id, actor_user_id, idempotency_key, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. | — |
| data.import BLOCK: 1 · WARN: 0 | account_id, actor_user_id, idempotency_key, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. | — |
| identity.user_create BLOCK: 1 · WARN: 0 | account_id, actor_user_id, idempotency_key, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. | — |
| identity.user_delete BLOCK: 1 · WARN: 0 | account_id, actor_user_id, idempotency_key, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. | — |
| integrations.disconnect BLOCK: 1 · WARN: 0 | account_id, actor_user_id, idempotency_key, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. | — |
| support.case_update BLOCK: 1 · WARN: 0 | account_id, actor_user_id, idempotency_key, request_id, system_instructions, user_input, workflow, workflowName | Block when required integration context is missing. | — |
Legal & Responsibility Notice
Summary
Informational only
Provided for general guidance. Not legal, compliance, security, or professional advice.
You control implementation
You are responsible for policies, prompts, integrations, workflows, and regulatory requirements.
Liability limitation
To the maximum extent permitted by law, the company disclaims liability for losses arising from use of this documentation or implementations based on it.