diff --git a/bearer/status.go b/bearer/status.go
index dca20fe981b8bbdef523ccd0b2a1201bbd2a21af..8362452d383cbc74548d3c82aaa878426620bf93 100644
--- a/bearer/status.go
+++ b/bearer/status.go
@@ -66,6 +66,13 @@ //	// anything else is ours, not the caller's
 //
 // Without this, each service spells out the sentinel list again, which is the
 // five-line copy this package exists to stop.
+//
+// It answers for THIS package's vocabulary and nothing else, which is the trap
+// in the guard above: a service whose own refusals do not wrap these sentinels
+// sends its "bad token" straight into the else branch and answers 503 to a
+// caller whose credential really was the problem. Either wrap — an
+// ErrInvalidToken of your own that unwraps to ErrInvalid — or ask your own
+// predicate first and reach this one only for what it can have produced.
 func IsRefusal(err error) bool {
 	for _, sentinel := range []error{
 		ErrInvalid, ErrNotOurs, ErrForbidden, ErrRevoked, ErrUnavailable,