# CREDENTIAL_SCOPE

The credential's grade does not permit this operation. HTTP 403. Evaluation credentials compile and check; storage needs a full credential.

The credential is valid, and the operation is outside what its grade allows.

## The envelope

```json
{"ok": false,
 "error": {"code": "CREDENTIAL_SCOPE",
           "message": "an evaluation credential may compile, check and fetch the prompt pack; saving a ruleset needs a full credential",
           "docs": "https://docs.agents.jaxon.ai/errors/credential-scope.md"},
 "versions": {"...": "..."}}
```

## What each grade may do

| Operation | Evaluation | Full |
| --- | --- | --- |
| Compile | yes | yes |
| Check | yes | yes |
| Prompt pack | yes | yes |
| Account status, unit library lookup | yes | yes |
| Save a ruleset under a name | no | yes |
| Record an approval | no | yes |
| Add a unit converter | no | yes |
| Load or list saved rulesets | no | yes |

Scope is checked before caps, so a capped caller asking for storage hears
about the scope — the thing it can act on — rather than the limit it would hit
anyway.

## The fix

Everything an evaluation credential needs for a first result is in scope:
compile, extract with the prompt pack, check. For persistence — a named
revision a person approves, a converter a project depends on — a **full**
credential is issued by Jaxon on request. In the meantime, pass `source` to
each check instead of a stored hash; the result is identical.

See also: [`CREDENTIAL_REQUIRED`](credential-required.md), [Error codes](../reference/errors.md).