{"record":{"id":"0e602f2856f40200","repo":"phacility/phabricator","slug":"err-policy","errorCode":"err:policy","errorMessage":"This mail is addressed to an object (\"%s\") you do not have permission to see: %s","messagePattern":"This mail is addressed to an object \\(\"(.+?)\"\\) you do not have permission to see: (.+?)","errorType":"exception","errorClass":"PhabricatorMetaMTAReceivedMailProcessingException","httpStatus":null,"severity":"error","filePath":"src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php","lineNumber":50,"sourceCode":"    PhutilEmailAddress $target) {\n\n    $parts = $this->matchObjectAddress($target);\n    if (!$parts) {\n      // We should only make it here if we matched already in \"canAcceptMail()\",\n      // so this is a surprise.\n      throw new Exception(\n        pht(\n          'Failed to parse object address (\"%s\") during processing.',\n          (string)$target));\n    }\n\n    $pattern = $parts['pattern'];\n    $sender = $this->getSender();\n\n    try {\n      $object = $this->loadObject($pattern, $sender);\n    } catch (PhabricatorPolicyException $policy_exception) {\n      throw new PhabricatorMetaMTAReceivedMailProcessingException(\n        MetaMTAReceivedMailStatus::STATUS_POLICY_PROBLEM,\n        pht(\n          'This mail is addressed to an object (\"%s\") you do not have '.\n          'permission to see: %s',\n          $pattern,\n          $policy_exception->getMessage()));\n    }\n\n    if (!$object) {\n      throw new PhabricatorMetaMTAReceivedMailProcessingException(\n        MetaMTAReceivedMailStatus::STATUS_NO_SUCH_OBJECT,\n        pht(\n          'This mail is addressed to an object (\"%s\"), but that object '.\n          'does not exist.',\n          $pattern));\n    }\n\n    $sender_identifier = $parts['sender'];","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php#L32-L68","documentation":"loadObject() for the object named in the mail address (e.g. the T123 in T123+hash@...) threw PhabricatorPolicyException: the sender, as a PhabricatorUser, is not allowed to see that object. The mail is rejected with STATUS_POLICY_PROBLEM ('err:policy') and the policy exception's own message is embedded, so the received-mail record explains exactly which policy blocked access.","triggerScenarios":"Replying by mail to a task/project whose policy was tightened after the notification was sent (restricted project, moved into a Space); a user mailing an object address directly for an object they have never had access to; newly created or external-collaborator accounts without membership in the required project.","commonSituations":"Policy or Space changes after notifications went out; users replying to very old threads for now-restricted objects; partner accounts collaborating on only part of an install.","solutions":["Grant the sender view access to the object (edit its policy, add the user to the project, or adjust Space membership).","If the restriction is intentional, tell the sender to stop replying by mail and request access through the web UI.","Read the embedded policy message in the received-mail record — it names the blocking policy."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before notifying a user by mail, confirm they can see the object:\n$visible = id(new PhabricatorObjectQuery())\n  ->setViewer($user)\n  ->withPHIDs(array($object->getPHID()))\n  ->execute();\nif (!$visible) {\n  // skip or adjust the mail: recipient cannot see this object\n}","typeGuard":null,"tryCatchPattern":"try {\n  $receiver->processReceivedMail($mail, $target);\n} catch (PhabricatorMetaMTAReceivedMailProcessingException $ex) {\n  if ($ex->getStatusCode() === MetaMTAReceivedMailStatus::STATUS_POLICY_PROBLEM) {\n    // reply explaining the sender lacks access to the target object\n  }\n}","preventionTips":["When tightening object policies or moving objects between Spaces, expect mail replies from users who lost access to fail with err:policy.","Audit subscriber lists after policy changes and remove users who can no longer see the object.","Educate users that replying by mail requires the same view permission as the web UI."],"tags":["php","phabricator","permissions","policy","mail"],"backgroundTag":"permission-denied","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}