# X_TENANCY_CROSS_DENIED

## Means

a cross-tenant read was entered without the capability

## Typical cause

`crossTenant()` called by an actor lacking `tenancy:cross`, or outside every request context — the capability is re-checked on every plan built inside the scope, so an actor swapped in by `withChildContext()` does not inherit the reach

## Fix

mint the actor with the scope — `serviceActor({ id: 'reconciler', scopes: ['tenancy:cross'] })` — run inside `runWithContext(ctxOf({ actor }), fn)`, and wrap the reads in `crossTenant('<why this spans tenants>', fn)`; the reason is required and non-blank, because it is what the next reader greps for

[Policy and authz](/error-codes#policy-and-authz)