diff --git a/docs/plans/2026-08-04-authz-permissions-implementation.md b/docs/plans/2026-08-04-authz-permissions-implementation.md
index f8b6ee49..21c8903a 100644
--- a/docs/plans/2026-08-04-authz-permissions-implementation.md
+++ b/docs/plans/2026-08-04-authz-permissions-implementation.md
@@ -2408,6 +2408,7 @@ describe("@wrnexus/authz exports", () => {
       "createAuthzResolver",
       "expandRoles",
       "permissionMatches",
+      "deniedBy",
       "authzMiddleware",
       "can",
       "decideFor",
@@ -2435,7 +2436,7 @@ export { memoryPermissionStore, cachedPermissionStore, scopeKey } from "./store.
 export type { PermissionStore, CachedPermissionStore, CacheOptions, GrantEffect } from "./store.ts";
 export { memoryAuditSink, consoleAuditSink, safeRecord } from "./audit.ts";
 export type { AuthzAuditEvent, AuthzAuditSink, MemoryAuditSink } from "./audit.ts";
-export { createAuthzResolver, expandRoles, permissionMatches } from "./engine.ts";
+export { createAuthzResolver, expandRoles, permissionMatches, deniedBy } from "./engine.ts";
 export type { AuthzResolver, AuthzResolverOptions, DecideInput } from "./engine.ts";
 export {
   authzMiddleware,