{"record":{"id":"43756135043f0884","repo":"ruvnet/ruflo","slug":"inbound-authorization-denied-for-sourcenodeid","errorCode":null,"errorMessage":"Inbound authorization denied for ${sourceNodeId} (addr=${address})","messagePattern":"Inbound authorization denied for (.+?) \\(addr=(.+?)\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts","lineNumber":443,"sourceCode":"      sourceNodeId,\n      metadata: { address, reason: 'AUTHORIZATION_ERROR', messageType: message.type },\n    });\n    deps.logger.warn('Inbound rejected: enforce mode has no authorization evaluator');\n    return { accepted: false, reason: 'AUTHORIZATION_ERROR' };\n  }\n\n  if (authorizationDecision && !authorizationDecision.allowed) {\n    if (authorizationMode === 'enforce') {\n      await deps.audit.log('message_rejected', {\n        sourceNodeId,\n        metadata: {\n          address,\n          reason: 'AUTHORIZATION_DENIED',\n          messageType: message.type,\n          policyReason: authorizationDecision.reason,\n        },\n      });\n      deps.logger.warn(`Inbound authorization denied for ${sourceNodeId} (addr=${address})`);\n      return { accepted: false, reason: 'AUTHORIZATION_DENIED' };\n    }\n    deps.logger.warn(\n      `Inbound authorization would deny ${message.type} from ${sourceNodeId} ` +\n        `(mode=${authorizationMode})`,\n    );\n  }\n\n  // Touch lastSeen on every successful inbound — drives the\n  // discovery service's stale-peer detection.\n  peer.markSeen();\n\n  // Audit accepted delivery\n  await deps.audit.log('message_received', {\n    sourceNodeId,\n    metadata: {\n      address,\n      messageType: message.type,","sourceCodeStart":425,"sourceCodeEnd":461,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts#L425-L461","documentation":"The inbound authorization evaluator ran successfully and explicitly returned allowed:false for a peer message while in enforce mode. The denial (with policyReason from the decision) is audited as AUTHORIZATION_DENIED and the envelope is refused with accepted:false.","triggerScenarios":"Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:443 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Review the authorization policy for the denied node; grant the required capability or expect continued denials."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}