Typedeny-reasonOptional reason for access denial in the post-validate hook type deny-reason = deny-reason;