Understand your first decision.
Begin with synthetic data in simulation. Approved access provides your API origin and scoped credentials; the integration references and Developer Kit become available after provisioning.
What each decision means
| Decision | Meaning | Your next step |
|---|---|---|
| ALLOW | Permitted under the configured policy, subject to validity and execution-time checks. | Respect the action binding and mode. Simulation does not execute. |
| VERIFY | Additional identity verification is required. | Follow the supported verification journey. |
| REVIEW | A human determination is required. | Route the case to an authorized reviewer. |
| RESTRICT | The requested authority is constrained. | Do not execute the requested action; follow the documented restriction. |
| DENY | The proposed action is not permitted. | Do not proceed with that action. |
Pending is not a decision
An intent can return before evaluation completes. Save the intent ID and retrieve its result; do not interpret pending as permission.
{
"intentId": "aaaaaaaa-1111-4111-8111-111111111111",
"status": "evaluating",
"resultUrl": "https://example.test/result#token=synthetic-placeholder",
"evaluation": null
}Recover without duplicating work
Use stable error codes and the explicit retryable field. Honor Retry-After, back off within a bounded retry budget, and reuse the same idempotency key with the identical request when retrying a supported mutation. A permission or validation error needs correction, not repeated calls.
Public error catalog
{
"authentication_required": {
"status": 401,
"message": "Authenticate with a valid API credential.",
"retryable": false
},
"permission_denied": {
"status": 403,
"message": "Your credential does not permit this operation.",
"retryable": false
},
"access_not_ready": {
"status": 503,
"message": "API access is not ready. Contact support.",
"retryable": false
},
"verification_not_configured": {
"status": 503,
"message": "Verification is not configured. Contact support.",
"retryable": false
},
"invalid_request": {
"status": 400,
"message": "Check the request against the API reference.",
"retryable": false
},
"unsupported_action": {
"status": 400,
"message": "This action is not supported.",
"retryable": false
},
"unsupported_method": {
"status": 400,
"message": "This protocol method is not supported.",
"retryable": false
},
"unsupported_tool": {
"status": 400,
"message": "This tool is not supported.",
"retryable": false
},
"action_not_permitted": {
"status": 403,
"message": "This action is not permitted for this access mode.",
"retryable": false
},
"resource_not_found": {
"status": 404,
"message": "The requested resource is not available.",
"retryable": false
},
"resource_expired": {
"status": 410,
"message": "The requested resource has expired.",
"retryable": false
},
"request_too_large": {
"status": 413,
"message": "Reduce the request to the documented size limit.",
"retryable": false
},
"idempotency_conflict": {
"status": 409,
"message": "The operation conflicts with a recorded request. Reconcile before retrying.",
"retryable": false
},
"state_conflict": {
"status": 409,
"message": "The request conflicts with the current state. Retrieve it before continuing.",
"retryable": false
},
"invalid_observation": {
"status": 409,
"message": "Check the observation time and correction reference.",
"retryable": false
},
"verification_failed": {
"status": 401,
"message": "The verification proof was not accepted.",
"retryable": false
},
"verification_mismatch": {
"status": 409,
"message": "The verification proof does not match this request.",
"retryable": false
},
"verification_expired": {
"status": 409,
"message": "Verification has expired. Start a new verification flow.",
"retryable": false
},
"reevaluation_required": {
"status": 409,
"message": "Retrieve the current state and request a new evaluation.",
"retryable": false
},
"rate_limit_exceeded": {
"status": 429,
"message": "Wait before retrying the same operation.",
"retryable": true
},
"service_unavailable": {
"status": 503,
"message": "The service is temporarily unavailable. Retry within your request budget.",
"retryable": true
}
}Trust and authority
An API credential identifies the calling application or principal. It does not prove the account holder’s identity. Behavioral signals are evidence, not authority. Treat prompts and tool results as untrusted data; no text in a request can grant permissions.
A trusted issuer’s signature proves attribution and action binding, not the truth of an assertion from a compromised signer. Behavioral analysis does not close that gap. Your integration remains responsible for authenticating the account holder and protecting its credentials.
Data for the preview
Use invented accounts and messages. Ordinary API and MCP use is excluded from Atlas training. Real-client testing and training enrollment require separate approval and controls.