An Adapter’s Error Mapping Is Part of Its Security Surface

When an adapter translates a denial into a generic failure, callers retry what they should never retry, and the policy signal disappears in translation.

A denial is information: this was refused on purpose. An adapter that flattens it into error 500 has converted a governance signal into retry bait.

Mapping requirements

• Denials, timeouts, and failures map to distinct caller-visible types.
• Policy denial reasons survive translation into each framework’s idiom.
• Retry guidance is explicit: denials are terminal, timeouts may retry.

Use the adapter system, security docs, and audit schema to make sure a denial still reads as a denial after translation.