{"record":{"id":"01bac4e94daf77cf","repo":"abpframework/abp","slug":"volo-authorization-010002","errorCode":"Volo.Authorization:010002","errorMessage":"Authorization failed! Given policy has not granted: {PolicyName}","messagePattern":"Authorization failed! Given policy has not granted: (.+?)","errorType":"exception","errorClass":"AbpAuthorizationException","httpStatus":403,"severity":"error","filePath":"framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs","lineNumber":120,"sourceCode":"    {\n        return (await authorizationService.AuthorizeAsync(resource, requirements)).Succeeded;\n    }\n\n    public static async Task<bool> IsGrantedAsync(this IAuthorizationService authorizationService, object resource, string policyName)\n    {\n        return (await authorizationService.AuthorizeAsync(resource, policyName)).Succeeded;\n    }\n\n    /// <summary>\n    /// Checks if CurrentPrincipal meets a specific authorization policy, throwing an <see cref=\"AbpAuthorizationException\"/> if not.\n    /// </summary>\n    /// <param name=\"authorizationService\">The <see cref=\"IAuthorizationService\"/> providing authorization.</param>\n    /// <param name=\"policyName\">The name of the policy to evaluate.</param>\n    public static async Task CheckAsync(this IAuthorizationService authorizationService, string policyName)\n    {\n        if (!await authorizationService.IsGrantedAsync(policyName))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedWithPolicyName)\n                .WithData(\"PolicyName\", policyName);\n        }\n    }\n\n    /// <summary>\n    /// Checks if CurrentPrincipal meets a specific requirement for the specified resource, throwing an <see cref=\"AbpAuthorizationException\"/> if not.\n    /// </summary>\n    /// <param name=\"authorizationService\">The <see cref=\"IAuthorizationService\"/> providing authorization.</param>\n    /// <param name=\"resource\">The resource to evaluate the policy against.</param>\n    /// <param name=\"requirement\">The requirement to evaluate the policy against.</param>\n    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, IAuthorizationRequirement requirement)\n    {\n        if (!await authorizationService.IsGrantedAsync(resource, requirement))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementHasNotGrantedForGivenResource)\n                .WithData(\"ResourceName\", resource);\n        }\n    }","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/abpframework/abp/blob/7ed43b1931b9df46a50c0c59148a18645641d0df/framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs#L102-L138","documentation":"Thrown by the CheckAsync(this IAuthorizationService, string policyName) extension when IsGrantedAsync(policyName) returns false for the current principal. The error code is Volo.Authorization:010002 (GivenPolicyHasNotGrantedWithPolicyName) and carries PolicyName as exception data. It is the named-policy variant of ABP's authorization check helpers.","triggerScenarios":"Calling authorizationService.CheckAsync(\"MyPolicy\") (or any ABP code path that resolves a named policy requirement) where the current user's principal does not satisfy that policy's requirements.","commonSituations":"User lacks the permission/role the policy requires; policy name typo means it resolves to a policy that always denies; permission granted to a different role; multi-tenant context where the permission isn't granted for the current tenant; missing PermissionDefinitionProvider registration.","solutions":["Grant the missing permission/role to the user for the current tenant via the permission management API.","Verify the policy name string exactly matches a defined policy/permission.","Check the current principal/claims and tenant context are what you expect (ICurrentUser, CurrentTenant).","Confirm the relevant PermissionDefinitionProvider / AuthorizationPolicy is registered."],"exampleFix":"// before\nawait AuthorizationService.CheckAsync(\"MyApp.Orders.Export\"); // throws 010002\n// after: grant the permission to the user's role\nawait PermissionManager.SetForRoleAsync(roleName, \"MyApp.Orders.Export\", true);","handlingStrategy":"validation","validationCode":"if (!await authorizationService.IsGrantedAsync(\"MyPolicy\"))\n{\n    // return 403 or hide the feature instead of letting CheckAsync throw\n}","typeGuard":"null","tryCatchPattern":"try { await authorizationService.CheckAsync(\"MyPolicy\"); }\ncatch (AbpAuthorizationException ex) when (ex.Code == \"Volo.Authorization:010002\")\n{ /* handle forbidden; ex.Data[\"PolicyName\"] has the policy */ }","preventionTips":["Use IsGrantedAsync to gate UI/feature visibility before calling CheckAsync.","Keep permission/policy names in constants to avoid typos.","Verify the PermissionDefinitionProvider registers every named policy you check.","Confirm tenant context when granting permissions."],"tags":["authorization","abp","security","permissions","policy"],"backgroundTag":null,"analyzedSha":"7ed43b1931b9df46a50c0c59148a18645641d0df","analyzedAt":"2026-08-13T16:26:11.351Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}