{"record":{"id":"6f3592bb10d81368","repo":"paperclipai/paperclip","slug":"subject-not-permitted","errorCode":"subject_not_permitted","errorMessage":"The agent run cannot start authorization for the requested user","messagePattern":"The agent run cannot start authorization for the requested user","errorType":"http","errorClass":"HttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-access.ts","lineNumber":6230,"sourceCode":"    name: string;\n  }): Promise<ToolExampleSmokeCheck> {\n    const decisionInput = {\n      companyId: input.companyId,\n      actor: input.actor,\n      request: {\n        applicationId: input.connection.applicationId,\n        connectionId: input.connection.id,\n        catalogEntryId: input.catalogEntry.id,\n        toolName: input.catalogEntry.toolName,\n        arguments: sampleArguments(input.catalogEntry.toolName),\n      },\n    };\n    const decision = await policySvc.decide(decisionInput);\n    const auditResult = await policySvc.writeAudit(decisionInput, decision, \"policy_decision\");\n    return {\n      name: input.name,\n      ok: decision.decision === input.expectedDecision,\n      toolName: input.catalogEntry.toolName,\n      expectedDecision: input.expectedDecision,\n      decision: decision.decision,\n      reasonCode: decision.reasonCode,\n      explanation: decision.explanation,\n      auditEventId: auditResult.legacyAuditEvent.id,\n      toolCallEventId: auditResult.toolCallEvent.id,\n    };\n  }\n\n  function actionSummary(entry: ToolCatalogEntry): ToolAppConnectionActionSummary {\n    return {\n      catalogEntryId: entry.id,\n      toolName: entry.toolName,\n      title: entry.title,\n      description: entry.description,\n      riskLevel: entry.riskLevel,\n      isReadOnly: entry.isReadOnly,\n      isWrite: entry.isWrite,","sourceCodeStart":6212,"sourceCodeEnd":6248,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-access.ts#L6212-L6248","documentation":"Authorization-scope guard in startAuthorizationForAgent: the agent run's responsible user does not match the subjectUserId on whose behalf OAuth consent was requested. Prevents an agent run from initiating consent for a different user's identity; the mismatched subject user is at fault.","triggerScenarios":"Thrown at server/src/services/tool-access.ts:6021 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The run's context cannot initiate authorization for that user. Ensure the run is associated with the requesting user or start authorization from an interactive session."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}