Reading a refusal
What a refusal message tells you, and what to do about it.
On this page 3 sections
A refusal looks like this:
ERROR refused by MSL Admin Portal: instance.delete is not allowed
- Ubuntu is the working instance - no deleting it. Set by Abi.Four parts, and each is there on purpose.
| Part | Why |
|---|---|
instance.delete | The exact capability, so you can look it up or ask for it by name. |
is not allowed | What happened. Nothing was changed. |
| the reason | Written by whoever set the policy. |
Set by Abi | Who to ask. |
A managed Mac that will not say why it refused is the thing people hate most about managed machines, so MSL always says all four.
Denied by something broader#
Sometimes you will see (denied by public). That means the administrator denied the whole public group, not that one capability. Useful, because asking for public.relay back when the whole group is denied is the wrong conversation.
Things that are never refused#
Anything that makes the Mac less exposed goes through, whatever the policy says:
- Unpublishing an instance, removing an authorised key, forgetting a notification address
- Closing a forwarded port, detaching a USB device
- Locking an instance, removing a peripheral share, turning startup off
- Clearing a per-app launch command
Otherwise denying a capability after somebody had already turned something on would trap it on, with no way back. Queries are never refused either: you can always read what the rules are.
In the app#
The same thing in a window: a control that a policy forbids is disabled with the reason as its tooltip, or the panel explains it where the control would be. The reason is always the administrator's own words.