A real example:

# zabbix_get -s 127.0.0.1 -k "agent.ping"
1

# zabbix_get -s 127.0.0.1 -k "pg.connect[hostaddr=127.0.0.1 port=6543 user=test,zbx001]"
zabbix_get [29168]: Check access restrictions in Zabbix agent configuration

What happened here - I don't know, maybe the loadable module has simply crashed (ZBX-10428), but I'm sure that the message has to be more technically correct.
I'd change it to:

"Connection has been closed by remote side, 0 bytes has been received.
Most likely access restrictions in Zabbix agent configuration should be checked"

The message is from C code of zabbix_get:

{
      if (0 == bytes_received)
	      zbx_error("Check access restrictions in Zabbix agent configuration");
      ret = FAIL;
}

Note - the message in code is used twice, make sure to sync both places.

Worth to note how zabbix server (3.0) marks the host when agent rejects connections to not allowed server:

Received empty response from Zabbix Agent at [127.0.0.1]. Assuming that agent dropped connection because of access permissions.

Maybe it should be taken as an example for zabbix_get too? Looks like a reasonable approach.

Before version 3.0 zabbix_get printed nothing in such case.