{"record":{"id":"5d12431617bdb370","repo":"paperclipai/paperclip","slug":"activity-is-outside-this-actor-s-authorization-bou","errorCode":null,"errorMessage":"Activity is outside this actor's authorization boundary","messagePattern":"Activity is outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/activity.ts","lineNumber":182,"sourceCode":"      ...result,\n      items: result.items.map((item) => ({\n        ...item,\n        agentId: null,\n        runId: null,\n        responsibleUserId: null,\n        details: null,\n      })),\n    };\n  }\n\n  async function assertCompanyScopeReadAllowed(req: Parameters<typeof assertCompanyAccess>[0], res: any, companyId: string) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"company_scope:read\",\n      resource: { type: \"company\", companyId },\n    });\n    if (decision.allowed) return true;\n    res.status(403).json({ error: \"Activity is outside this actor's authorization boundary\" });\n    return false;\n  }\n\n  async function assertIssueReadAllowed(req: Parameters<typeof assertCompanyAccess>[0], res: any, issue: {\n    id: string;\n    companyId: string;\n    projectId: string | null;\n    parentId: string | null;\n    assigneeAgentId: string | null;\n    assigneeUserId: string | null;\n    status: string;\n  }) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"issue:read\",\n      resource: {\n        type: \"issue\",\n        companyId: issue.companyId,","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/routes/activity.ts#L164-L200","documentation":"Authorization gate in the activity routes: the access decision for the 'company_scope:read' action on this company returned denied, meaning the actor (agent or restricted user) may not read activity at company scope. The route responds 403 rather than leaking scoped activity data.","triggerScenarios":"Thrown at server/src/routes/activity.ts:182 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Request activity only for companies the actor is authorized to access."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}