Nothing to try yet
A 'grant refused' safeguards error path exists but its triggering checks always return false.
A new branch in the API-error handler can emit "grant_refused" telemetry under a "safeguards_skip" event with a message built from the error, but the checks that would trigger it currently always return false and an empty string, so the branch is unreachable in this build.