DENY/workspace-policy
Blocked by workspace policy
A workspace-scoped rule denied this tool call before it left the device.
What it means
Workspace policies layer on top of the signed bundle. This denial is the workspace refusing the call — usually a deny-list match or an allowlist miss for the current agent.
Common causes
- Tool appears in the workspace `deniedTools` list.
- Tool is not in the workspace `allowedTools` list when one is set.
- Workspace has an active break-glass rule.
How to fix
- Open Settings → Workspace policy and review the matching rule.
- Dry-run the call (`⌘⇧D`) to see which rule fires.
- If intended, adjust the workspace bundle and re-sign.