Exact failure modes

AllowKit fails closed. A failed policy check means no policy signature, and no policy signature means the escrow does not release funds.

Code	Meaning
agent_paused	Agent is paused. Resume only after checking the requested service and policy revision.
service_not_approved	Service id or recipient is not on policy. Approve the service or keep it blocked.
budget_exceeded	Daily, weekly, or max-per-payment cap would be crossed. Lower amount or change policy.
approval_required	Payment is above approval threshold. Human approval is required before settlement — see Approvals.
asset_mismatch	Payment asset does not match allowance asset. Use the right allowance or convert first.
policy_signer_unavailable	AllowKit cannot evaluate/co-sign. Retry with same idempotency key; funds do not move.