# X_POLICY_SURFACE_UNKNOWN

## Means

enforce() was handed a surface no adapter answers to

## Typical cause

`enforce(surface, policy, args)` called with a value outside `'http' \| 'live' \| 'job' \| 'mcp'` — a config-driven table, a surface name off the wire, or a JS host, none of which the type reached. Refused rather than dispatched because the adapter table is an object literal and so inherits `Object.prototype`: `adapters['valueOf']` answered a FUNCTION, `enforce('valueOf', …)` called it with the table as its receiver, and the truthy return was the adapter table typed as a `SurfaceDenial` — an authz dispatch that failed CLOSED with a denial carrying no code and no reason

## Fix

pass one of `http`, `live`, `job`, `mcp` — `enforce('http', policy, args)` — or add the adapter for the new surface in `packages/policy/src/surfaces.ts`, the one place a fifth may be declared

[Policy and authz](/error-codes#policy-and-authz)