/**
 * Resource a root-task unlock acts on. The kind only varies the message
 * wording — both unlock engines share one remediation story (the SCP
 * carve-out covers the five s3/sqs policy-management actions together).
 */
export interface UnlockResource {
    kind: "bucket" | "queue";
    name: string;
}
/**
 * Failure copy for an AccessDenied hitting a root session mid-unlock.
 * Coupled value at 2 sites (unlockBucket + unlockQueue): the remediation
 * story must stay identical, so the copy lives here rather than per-engine.
 */
export declare function formatScpSuspectedFailure(action: string, resource: UnlockResource, accountId: string): string;