The caller-facing disclosure, served verbatim — required here, where ErrorResponseInit leaves it optional, because a hint that omitted it would fall back to the Error's own message.

It must contain nothing the thrower would not put in an unauthenticated response body.