# Reason Codes (074)

This file defines the baseline `reason_code` taxonomy for verification check results.

## Rules

- Reason codes are **stable** and **machine-readable**.
- New codes must be appended (avoid renames) to keep support and automation stable.
- Flow/check-specific codes must use the reserved namespace: `ext.*`.

## Baseline Codes (v1)

- `ok` — Check passed.
- `not_applicable` — Check skipped because it doesn’t apply to this identity/scope.
- `missing_configuration` — Required config is absent.
- `permission_denied` — Insufficient permissions / consent missing.
- `authentication_failed` — Token acquisition or auth precondition failed.
- `throttled` — Remote dependency throttled (e.g., 429/503) and check could not complete.
- `dependency_unreachable` — Remote dependency unavailable.
- `invalid_state` — Local model state conflicts with required preconditions.
- `unknown_error` — Failure could not be classified.

## Reserved Extension Namespace

- `ext.<flow>.<detail>` — Flow-specific extensions.
  - Example: `ext.managed_tenant_onboarding.role_mapping_missing`