{"record":{"id":"54877ddaeb9ab255","repo":"paperclipai/paperclip","slug":"responsible-user-unauthorized","errorCode":"RESPONSIBLE_USER_UNAUTHORIZED","errorMessage":"Responsible user is not authorized for write access","messagePattern":"Responsible user is not authorized for write access","errorType":"http","errorClass":"HttpError","httpStatus":403,"severity":"error","filePath":"server/src/routes/authz.ts","lineNumber":23,"sourceCode":"import { responsibleUserAuthzShadowMode } from \"../services/authorization.js\";\n\nfunction throwOrShadowResponsibleUserCompanyAccessDeny(\n  req: Request,\n  companyId: string,\n  code: \"RESPONSIBLE_USER_UNAUTHORIZED\" | \"RESPONSIBLE_USER_UNAVAILABLE\",\n  message: string,\n) {\n  logger.warn({\n    authzMode: responsibleUserAuthzShadowMode() ? \"shadow\" : \"enforce\",\n    code,\n    action: \"company_access\",\n    companyId,\n    actorAgentId: req.actor.agentId ?? null,\n    responsibleUserId: req.actor.onBehalfOfUserId ?? null,\n    method: req.method,\n  }, \"responsible-user company access intersection denied\");\n  if (responsibleUserAuthzShadowMode()) return;\n  throw new HttpError(403, message, { code });\n}\n\nexport function assertAuthenticated(req: Request) {\n  if (req.actor.type === \"none\") {\n    throw unauthorized();\n  }\n}\n\nexport function assertBoard(req: Request) {\n  if (req.actor.type !== \"board\") {\n    throw forbidden(\"Board access required\");\n  }\n}\n\nexport function hasBoardOrgAccess(req: Request) {\n  if (req.actor.type !== \"board\") {\n    return false;\n  }","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/routes/authz.ts#L5-L41","documentation":"Responsible-user authorization sentinel (code RESPONSIBLE_USER_UNAUTHORIZED) raised from assertCompanyAccess: the responsible user an agent acts on behalf of is not in the intersection of users authorized for this company's write access. In enforce mode the request is denied; in shadow mode only a warning is logged.","triggerScenarios":"Thrown at server/src/routes/authz.ts:23 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Grant the company's responsible user write access, or choose a different actor with write permission."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}