Diagnose the boundary that rejected the request.

401 Authentication required

Confirm the browser sent credentials or the client sent the intended API key. A browser cannot read the HttpOnly session cookie; check /api/auth/session instead.

403 Capability or scope denied

Authentication succeeded, but entitlement, membership, role, project scope, or capability authorization did not. Do not work around this in frontend state.

404 Resource not found

Verify both the identifier and the active scope. Eventium may intentionally return not found when exposing resource existence would cross a boundary.

409 Conflict

Refresh the current resource or membership revision before retrying a state-changing action.

429 or retryable 5xx

Use bounded exponential backoff only when the response identifies a retryable condition. Do not retry validation, authorization, or policy failures.

No Atlas evidence

Treat this as a first-class result. Ask for authorized evidence or adjust scope; never fill the gap with an unrelated local cache or ungrounded model output.