When an operation stops

Check missing_arguments, target, profile and credential source. Fill input gaps before considering permissions.

Check audience, expiry and identity for authentication rejection. For denied access, compare target scope, token scopes, consent and role evidence with declared conditions. Resolve a related action’s required_context first.

Partial result evidence is retained. Exit code 2 does not mean an empty inventory or complete success; inspect the unresolved part.

Preserve the original receipt, plan and journal and perform the indicated readback. An uncertain response is not a reason to repeat apply or deletion.

Follow diagnostic.inspect_argv to retain the selected resource when opening full requirements. Public reports need no secret values or transport headers.