# Troubleshooting

`CREDENTIAL_NOT_FOUND`: provide `TS_CLIENT_SECRET` or a supported trust credential env. `CREDENTIAL_AMBIGUOUS`: provide an explicit credential selection. A policy or cleanup permission error is non-retryable and must be fixed by granting the documented Tailscale scope. Binary, DNS, TLS and Funnel adapters must report verification failure rather than claiming success.