Canonical, structured refusal handed back to the model whenever a resource access is denied. Centralizing it here keeps every enforcement point (a tool's own declared permissions, the runtime context, the server guard) emitting the same machine-readable shape — `{ error, kind, resource, message, hint? }` — so agents can relay denials consistently. The optional hint lets the server add UI-specific guidance.