X_PERMISSION_UNGRANTED
Means
an action, query or route requires a permission no role grants
Typical cause
The policy step: a single-permission rule no role in the app role map holds, so no actor can ever pass it
Fix
add '<permission>' to the grants of a role in apps/web/shared/roles.ts, then x verify --only policy