Application errors should distinguish expected business failures from unexpected server failures.

Examples of expected failures include invalid input, insufficient permissions, unavailable resources, or business-rule violations. These can be represented using stable error codes and structured metadata.

Unexpected internal failures should be logged with diagnostic details while exposing a safe message to the client.