# X_FORBIDDEN

## Means

policy denied this actor

## Typical cause

the actor exists but the policy said no. A remote caller — a production problem document, an app's MCP tool result — is given the error's `callerFix` instead: ask the account owner or an administrator for the permission (`As of 22.10`)

## Fix

`x policy explain <path> --json`

[HTTP](/error-codes#http)