{"record":{"id":"6f3592bb10d81368","repo":"paperclipai/paperclip","slug":"subject-not-permitted","errorCode":"subject_not_permitted","errorMessage":"The agent run cannot start authorization for the requested user","messagePattern":"The agent run cannot start authorization for the requested user","errorType":"http","errorClass":"HttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-access.ts","lineNumber":8653,"sourceCode":"      actor: input.actor,\n      request: {\n        applicationId: input.connection.applicationId,\n        connectionId: input.connection.id,\n        catalogEntryId: input.catalogEntry.id,\n        toolName: input.catalogEntry.toolName,\n        arguments: sampleArguments(input.catalogEntry.toolName),\n      },\n    };\n    const decision = await policySvc.decide(decisionInput);\n    const auditResult = await policySvc.writeAudit(\n      decisionInput,\n      decision,\n      \"policy_decision\",\n    );\n    return {\n      name: input.name,\n      ok: decision.decision === input.expectedDecision,\n      toolName: input.catalogEntry.toolName,\n      expectedDecision: input.expectedDecision,\n      decision: decision.decision,\n      reasonCode: decision.reasonCode,\n      explanation: decision.explanation,\n      auditEventId: auditResult.legacyAuditEvent.id,\n      toolCallEventId: auditResult.toolCallEvent.id,\n    };\n  }\n\n  function actionSummary(\n    entry: ToolCatalogEntry,\n  ): ToolAppConnectionActionSummary {\n    return {\n      catalogEntryId: entry.id,\n      toolName: entry.toolName,\n      title: entry.title,\n      description: entry.description,\n      riskLevel: entry.riskLevel,","sourceCodeStart":8635,"sourceCodeEnd":8671,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/services/tool-access.ts#L8635-L8671","documentation":"Authorization-scope guard in startAuthorizationForAgent: the agent run's responsible user does not match the subjectUserId on whose behalf OAuth consent was requested. Prevents an agent run from initiating consent for a different user's identity; the mismatched subject user is at fault.","triggerScenarios":"Thrown at server/src/services/tool-access.ts:6021 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The run's context cannot initiate authorization for that user. Ensure the run is associated with the requesting user or start authorization from an interactive session."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}