The network explicitly denied this service (Service denied).
Where you see it
In the Cause IE of a GTPv2-C response (Create Session, Modify Bearer, Delete Session…) on S11, S5 or S8.
What to check
Check subscription/policy configuration for why this service was denied.
Check which node sent the response (MME, SGW or PGW): the cause belongs to that node's decision.
Got a trace with GTPv2 cause 89 Service denied? Drop it in the analyzer: it finds the step that really failed first, which node sent the code and what to ask the other side. Captures, test-system PDFs and vendor exports. 5 free analyses a month, no sign-up.