Tencent/WeKnora · error

document %s is not within the current @mention scope

Error message

document %s is not within the current @mention scope

What it means

Document-level scope rejection: KB containment passed but the document ID is not among the explicitly @mentioned/allowed document IDs for this execution, so the fine-grained mention scope denies access even though the KB itself is in scope.

Source

Thrown at internal/agent/tools/scope_authorization.go:89

	}
	knowledge, err := knowledgeService.GetKnowledgeByIDOnly(ctx, knowledgeID)
	if err != nil || knowledge == nil {
		if err == nil {
			err = fmt.Errorf("empty result")
		}
		return nil, fmt.Errorf("document %s not found: %w", knowledgeID, err)
	}
	if !searchTargets.ContainsKB(knowledge.KnowledgeBaseID) {
		return nil, fmt.Errorf("knowledge base %s is not within the current Agent scope", knowledge.KnowledgeBaseID)
	}
	allowed, err := searchTargetsAllowKnowledgeID(
		ctx, searchTargets, knowledge.ID, knowledge.KnowledgeBaseID, knowledgeService,
	)
	if err != nil {
		return nil, fmt.Errorf("failed to validate document scope: %w", err)
	}
	if !allowed {
		return nil, fmt.Errorf("document %s is not within the current @mention scope", knowledge.ID)
	}
	return knowledge, nil
}

// authorizeChunkInSearchTargets is the chunk/FAQ counterpart of
// authorizeKnowledgeInSearchTargets. A chunk ID is accepted only after the
// server resolves its owning document and validates that document against the
// full KB/document/tag scope.
func authorizeChunkInSearchTargets(
	ctx context.Context,
	searchTargets types.SearchTargets,
	chunkID string,
	chunkService interfaces.ChunkService,
	knowledgeService interfaces.KnowledgeService,
) (*types.Chunk, error) {
	chunkID = strings.TrimSpace(chunkID)
	if chunkID == "" {
		return nil, fmt.Errorf("chunk_id is required")

View on GitHub (pinned to 988cbb0330)

Solutions

1. Include the document in the @mention set or allowed document list
2. Verify the mention scope resolution produced the expected IDs
3. Request access through scope configuration rather than bypassing the check

When it happens

Trigger: Thrown at internal/agent/tools/scope_authorization.go:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/086f6422dd742ba5. Report an issue: GitHub.