CREDENTIAL_SCOPE
The credential's grade does not permit this operation. HTTP 403. Evaluation credentials compile and check; storage needs a full credential.
The credential is valid, and the operation is outside what its grade allows.
The envelope
{"ok": false,
"error": {"code": "CREDENTIAL_SCOPE",
"message": "an evaluation credential may compile, check and fetch the prompt pack; saving a ruleset needs a full credential",
"docs": "https://docs.agents.jaxon.ai/errors/credential-scope.md"},
"versions": {"...": "..."}}What each grade may do
| Operation | Evaluation | Full |
|---|---|---|
| Compile | yes | yes |
| Check | yes | yes |
| Prompt pack | yes | yes |
| Account status, unit library lookup | yes | yes |
| Save a ruleset under a name | no | yes |
| Record an approval | no | yes |
| Add a unit converter | no | yes |
| Load or list saved rulesets | no | yes |
Scope is checked before caps, so a capped caller asking for storage hears about the scope — the thing it can act on — rather than the limit it would hit anyway.
The fix
Everything an evaluation credential needs for a first result is in scope: compile, extract with the prompt pack, check. For persistence — a named revision a person approves, a converter a project depends on — a full credential is issued by Jaxon on request. In the meantime, pass source to each check instead of a stored hash; the result is identical.
See also: [CREDENTIAL_REQUIRED](credential-required.md), Error codes.