diff --git a/security/agent/keymgr/client.go b/security/agent/keymgr/client.go
index 7a93f31..fa36a4c 100644
--- a/security/agent/keymgr/client.go
+++ b/security/agent/keymgr/client.go
@@ -11,7 +11,17 @@
 	"veyron.io/veyron/veyron/lib/unixfd"
 	"veyron.io/veyron/veyron/security/agent/server"
 	"veyron.io/veyron/veyron2/context"
-	"veyron.io/veyron/veyron2/verror"
+	verror "veyron.io/veyron/veyron2/verror2"
+)
+
+const pkgPath = "veyron.io/veyron/veyron/security/agent/keymgr"
+
+// Errors
+var (
+	errInvalidResponse = verror.Register(pkgPath+".errInvalidResponse",
+		verror.NoRetry, "{1:}{2:} invalid response from agent. (expected {3} bytes, got {4})")
+	errInvalidKeyHandle = verror.Register(pkgPath+".errInvalidKeyHandle",
+		verror.NoRetry, "{1:}{2:} Invalid key handle")
 )
 
 const defaultManagerSocket = 4
@@ -42,7 +52,7 @@
 // NewPrincipal creates a new principal and returns the handle and a socket serving
 // the principal.
 // Typically the socket will be passed to a child process using cmd.ExtraFiles.
-func (a *Agent) NewPrincipal(_ context.T, inMemory bool) (handle []byte, conn *os.File, err error) {
+func (a *Agent) NewPrincipal(ctx context.T, inMemory bool) (handle []byte, conn *os.File, err error) {
 	req := make([]byte, 1)
 	if inMemory {
 		req[0] = 1
@@ -61,7 +71,7 @@
 	}
 	if n != server.PrincipalHandleByteSize {
 		conn.Close()
-		return nil, nil, verror.BadProtocolf("invalid response from agent. (expected %d bytes, got %d)", server.PrincipalHandleByteSize, n)
+		return nil, nil, verror.Make(errInvalidResponse, ctx, server.PrincipalHandleByteSize, n)
 	}
 	return buf, conn, nil
 }
@@ -84,7 +94,7 @@
 // Typically this will be passed to a child process using cmd.ExtraFiles.
 func (a *Agent) NewConnection(handle []byte) (*os.File, error) {
 	if len(handle) != server.PrincipalHandleByteSize {
-		return nil, verror.BadArgf("Invalid key handle")
+		return nil, verror.Make(errInvalidKeyHandle, nil)
 	}
 	a.mu.Lock()
 	defer a.mu.Unlock()
diff --git a/security/agent/server/server.go b/security/agent/server/server.go
index b753987..37f6970 100644
--- a/security/agent/server/server.go
+++ b/security/agent/server/server.go
@@ -22,12 +22,22 @@
 	"veyron.io/veyron/veyron2/options"
 	"veyron.io/veyron/veyron2/security"
 	"veyron.io/veyron/veyron2/vdl/vdlutil"
-	"veyron.io/veyron/veyron2/verror"
+	verror "veyron.io/veyron/veyron2/verror2"
 	"veyron.io/veyron/veyron2/vlog"
 )
 
 const PrincipalHandleByteSize = sha512.Size
 
+const pkgPath = "veyron.io/veyron/veyron/security/agent/server"
+
+// Errors
+var (
+	errStoragePathRequired = verror.Register(pkgPath+".errStoragePathRequired",
+		verror.NoRetry, "{1:}{2:} RunKeyManager: storage path is required")
+	errNotMultiKeyMode = verror.Register(pkgPath+".errNotMultiKeyMode",
+		verror.NoRetry, "{1:}{2:} Not running in multi-key mode")
+)
+
 type keyHandle [PrincipalHandleByteSize]byte
 
 type agentd struct {
@@ -63,7 +73,7 @@
 // The returned 'client' is typically passed via cmd.ExtraFiles to a child process.
 func RunKeyManager(runtime veyron2.Runtime, path string, passphrase []byte) (client *os.File, err error) {
 	if path == "" {
-		return nil, verror.BadArgf("storage path is required")
+		return nil, verror.Make(errStoragePathRequired, nil)
 	}
 
 	mgr := &keymgr{path: path, passphrase: passphrase, principals: make(map[keyHandle]security.Principal), runtime: runtime}
@@ -245,7 +255,7 @@
 
 func (a keymgr) newKey(in_memory bool) (id []byte, p security.Principal, err error) {
 	if a.path == "" {
-		return nil, nil, verror.NoAccessf("not running in multi-key mode")
+		return nil, nil, verror.Make(errNotMultiKeyMode, nil)
 	}
 	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	keyHandle, err := keyid(key)