# policy_denied

> A policy does not allow this. A platform or workspace policy forbids this action outright, whoever asks.

**A policy does not allow this.** A platform or workspace policy forbids this action outright, whoever asks. Unlike `approval_required`, there is nothing to approve.

- **HTTP status:** `403 Forbidden`
- **CLI exit code:** `3` (forbidden or denied by policy)
- **Retry:** not as it is; the same request will fail the same way until the cause is fixed

## How to fix it

See policy.reasons[]; change the request to satisfy policy {policy}.

Words in `{braces}` are filled in from the error response, which names the exact resource.

## Common causes

- Exposing a special-category database to the internet.
- Turning off backups on a production database.

## What the response looks like

```json
{
  "type": "https://guv.dev/errors/policy_denied",
  "title": "A policy does not allow this",
  "status": 403,
  "code": "policy_denied",
  "detail": "A platform or workspace policy forbids this action outright, whoever asks.",
  "fix": "See policy.reasons[]; change the request to satisfy policy {policy}.",
  "docs_url": "https://guv.dev/errors/policy_denied",
  "request_id": "req_01jbx2m9k7q4r8t5v6w3y0z1rq"
}
```

The `code` field is stable: match on it, not on `title` or `detail`, which may be reworded.