The agent says its tool was denied

Open the run and find the tool step: it shows denied. The usual causes: the agent has no policy, or no rule matches the tool's service.operation. Add an allow (or ask-a-person) rule for it and try again.