Tencent/WeKnora · warning

rbac: ownership or role insufficient

Error message

rbac: ownership or role insufficient

What it means

ErrOwnershipForbidden is returned by EvaluateOwnershipOrRole / RequireOwnershipOrRole when the authenticated caller is neither the resource's creator nor holds the minimum role required. Handlers like knowledge.go map it to a 403 'No permission to operate on this knowledge base'.

Source

Thrown at internal/middleware/rbac.go:306

		c.JSON(http.StatusForbidden, gin.H{
			"error": "Forbidden: must own the resource or have the required role",
		})
		c.Abort()
	}
}

// rbacEnforcementEnabled reports whether middleware should actually
// reject failed checks. When the flag is off the middleware still runs
// role-only checks (logging, fast paths), but rejection is downgraded
// to a warning and ownership lookups are skipped entirely so the dormant
// rollout window incurs no per-request DB cost.
func rbacEnforcementEnabled(cfg *config.Config) bool {
	return cfg != nil && cfg.Tenant.IsRBACEnforced()
}

// ErrOwnershipForbidden is returned by EvaluateOwnershipOrRole when the
// caller is neither the resource creator nor meets the minimum role.
var ErrOwnershipForbidden = errors.New("rbac: ownership or role insufficient")

// EvaluateOwnershipOrRole applies the same decision matrix as
// RequireOwnershipOrRole for handlers that resolve creator_id out-of-band
// (e.g. KB id carried in a JSON body rather than a URL param).
//
// Returns nil when access is allowed. ErrResourceNotFound means the
// handler should issue its own 404. ErrOwnershipForbidden maps to 403.
// Any other error is a transient lookup failure (503).
func EvaluateOwnershipOrRole(
	ctx context.Context,
	cfg *config.Config,
	min types.TenantRole,
	creatorID string,
	lookupErr error,
) error {
	// API-key principals are authorized solely by the APIKeyGate (route
	// policy) plus the KB allow-list handlers enforce separately
	// (requireTenantAPIKeyKnowledgeBase(s)). Ownership ("creator OR Admin+")

View on GitHub (pinned to 988cbb0330)

Solutions

1. Confirm the authenticated user is actually the resource creator, or have an admin with sufficient role perform the operation.
2. Grant the user the required minimum role via your role-management flow if they should have access.
3. Verify creator_id resolution is correct — wrong KB id in the request body resolves the wrong creator.
4. If enforcement was recently enabled, audit role assignments before rolling out IsRBACEnforced to production.

Example fix

// before: client sends KB id owned by someone else
req := UpdateKBRequest{ID: otherUsersKBID, Name: "new name"}
// after: check ownership client-side or use an admin/service account with the required role
kb, _ := client.GetKnowledgeBase(ctx, kbID)
if kb.CreatorID != currentUserID && !userHasRole(ctx, "admin") {
    return ErrNoPermission
}
client.UpdateKnowledgeBase(ctx, req)

// before the call, confirm the user owns the resource or has the role
kb, _ := client.GetKnowledgeBase(ctx, kbID)
if kb.CreatorID != currentUserID && !userHasRole(ctx, minRequiredRole) {
    return ErrNoPermission
}

func isOwnershipForbidden(err error) bool {
    return errors.Is(err, middleware.ErrOwnershipForbidden)
}

if evalErr != nil {
    if errors.Is(evalErr, middleware.ErrOwnershipForbidden) {
        return errors.NewForbiddenError("No permission to operate on this knowledge base")
    }
    return evalErr
}

When it happens

Trigger: A user calls a mutating endpoint (update/delete KB, etc.) where the resolved creator_id differs from the caller's user ID and the caller's role is below the configured minimum. Also via EvaluateOwnershipOrRole when creator_id is resolved out-of-band (e.g. KB id in JSON body).

Common situations: A collaborator trying to edit someone else's knowledge base; role downgrades leaving former admins without ownership; clients sending a KB id in the body for a resource owned by another user; RBAC enforcement newly enabled (IsRBACEnforced) changing behavior for existing callers.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• rbac: resource not found
• wiki page %s returned knowledge base %s while resolving allo
• oauth authorization attempt does not match the current princ
• workspace mismatch: got %d want %d
• storage path has no tenant segment

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/53e88abb8a6f5760. Report an issue: GitHub.