{"record":{"id":"3917984661efd418","repo":"paperclipai/paperclip","slug":"execution-workspaces-are-outside-this-actor-s-auth","errorCode":null,"errorMessage":"Execution workspaces are outside this actor's authorization boundary","messagePattern":"Execution workspaces are outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/execution-workspaces.ts","lineNumber":106,"sourceCode":"  const svc = executionWorkspaceService(db);\n  const access = accessService(db);\n  const workspaceOperationsSvc = workspaceOperationService(db);\n  const runtimeLeases = workspaceRuntimeLeaseService(db);\n  const heartbeat = heartbeatService(db, {\n    pluginWorkerManager: opts.pluginWorkerManager,\n  });\n  const environmentRuntime = environmentRuntimeService(db, {\n    pluginWorkerManager: opts.pluginWorkerManager,\n  });\n\n  async function assertExecutionWorkspaceReadAllowed(req: Request, res: Response, companyId: string) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"company_scope:read\",\n      resource: { type: \"company\", companyId },\n    });\n    if (decision.allowed) return true;\n    res.status(403).json({ error: \"Execution workspaces are outside this actor's authorization boundary\" });\n    return false;\n  }\n\n  async function assertRuntimeManageAllowed(req: Request, res: Response, companyId: string) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"runtime:manage\",\n      resource: { type: \"company\", companyId },\n    });\n    if (decision.allowed) return true;\n    res.status(403).json({ error: \"Runtime service control is outside this actor's authorization boundary\" });\n    return false;\n  }\n\n  router.get(\"/companies/:companyId/execution-workspaces\", async (req, res) => {\n    const companyId = req.params.companyId as string;\n    assertCompanyAccess(req, companyId);\n    if (!(await assertExecutionWorkspaceReadAllowed(req, res, companyId))) return;","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/routes/execution-workspaces.ts#L88-L124","documentation":"Authorization gate in the execution-workspaces routes: the access decision for reading this company's execution workspaces was denied, so the actor may not list or read them and the route withholds everything with 403.","triggerScenarios":"Thrown at server/src/routes/execution-workspaces.ts:71 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}