Function is_scope_refusal 

fn is_scope_refusal(body: &[u8]) -> bool

Whether a 403 body is the usage endpoint’s scope refusal rather than an auth failure. Keyed on the body’s error.details.error_code - the verified live shape for a valid setup token; a revoked one answers 401 authentication_error, so the two never share a class.