{"record":{"id":"32c56046c55f6e39","repo":"paperclipai/paperclip","slug":"agent-is-outside-this-actor-s-authorization-bounda","errorCode":null,"errorMessage":"Agent is outside this actor's authorization boundary","messagePattern":"Agent is outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/agents.ts","lineNumber":604,"sourceCode":"    row.adapterType === identity.adapterType;\n  const inMemorySetupTokenCleanupStore: SetupTokenCleanupStore = {\n    async record(record): Promise<void> {\n      setupTokenCleanupRows.set(record.sessionId, { ...record });\n    },\n    async markState(identity, state): Promise<void> {\n      const row = setupTokenCleanupRows.get(identity.sessionId);\n      if (row && scopeMatchesRow(row, identity)) row.state = state;\n    },\n    async remove(identity): Promise<void> {\n      // The delete matches the full owner scope, so it never removes a row by the\n      // session id alone.\n      const row = setupTokenCleanupRows.get(identity.sessionId);\n      if (row && scopeMatchesRow(row, identity)) setupTokenCleanupRows.delete(identity.sessionId);\n    },\n    async listReapable(): Promise<SetupTokenCleanupRecord[]> {\n      return [];\n    },\n    async consumeStoredClaim(identity): Promise<SetupTokenCleanupRecord | null> {\n      const row = setupTokenCleanupRows.get(identity.sessionId);\n      if (\n        !row ||\n        !scopeMatchesRow(row, identity) ||\n        row.state !== \"stored\" ||\n        row.boundAt !== null ||\n        row.deadline <= Date.now()\n      ) {\n        return null;\n      }\n      row.boundAt = Date.now();\n      return { ...row };\n    },\n    async cancelDurable(identity, cancellableStates): Promise<SetupTokenCleanupRecord | null> {\n      const row = setupTokenCleanupRows.get(identity.sessionId);\n      if (!row || !scopeMatchesRow(row, identity) || !cancellableStates.includes(row.state)) {\n        return null;\n      }","sourceCodeStart":586,"sourceCodeEnd":622,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/routes/agents.ts#L586-L622","documentation":"The agents route's access check (assertAgentReadAllowed / access.decide) denied agent:read for the requesting actor: the agent lies outside the actor's authorization boundary (wrong company or insufficient grants). Surfaced as a forbidden/authorization failure.","triggerScenarios":"Thrown at server/src/routes/agents.ts:584 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Access only agents within the actor's authorized company scope."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}