A server allows creating secure channels with policy 'None' for Discovery services, but only allows secure connections (policy not 'None') for normal UA session services.

If a client now creates a secure channel with policy 'None' and uses it to issue a CreateSession call (or any other service call), which error code should be returned by the server?

The best matching error code would be Bad_SecurityPolicyRejected, but this is an error code which may only be returned for the OpenSecureChannel service (see table 12 of part 4). Moving this error code to table 177 would resolve the problem.

Bad_SecurityChecksFailed would be another candidate, but is too unspecific for that case, as a client would not know that the unsupported security policy is the reason for the error.