{"record":{"id":"804aa8eb6584c52b","repo":"paperclipai/paperclip","slug":"agent-created-issues-cannot-set-responsibleuserid","errorCode":null,"errorMessage":"Agent-created issues cannot set responsibleUserId","messagePattern":"Agent-created issues cannot set responsibleUserId","errorType":"http","errorClass":null,"httpStatus":422,"severity":"error","filePath":"server/src/routes/issues.ts","lineNumber":621,"sourceCode":"  issue: { id: string; companyId: string; identifier: string | null };\n  surface: \"issue.comment.create\" | \"issue.patch.comment\";\n  requestedValue: string | null;\n}) {\n  const actor = getActorInfo(input.req);\n  await logActivity(input.db, {\n    companyId: input.issue.companyId,\n    actorType: actor.actorType,\n    actorId: actor.actorId,\n    agentId: actor.agentId,\n    runId: actor.runId,\n    agentApiKeyId: actor.agentApiKeyId,\n    responsibleUserIdOverride: authenticatedActorResponsibleUserId(input.req),\n    action: \"issue.attribution_spoof_rejected\",\n    entityType: \"issue\",\n    entityId: input.issue.id,\n    details: {\n      identifier: input.issue.identifier,\n      surface: input.surface,\n      field: \"onBehalfOfUserId\",\n      requestedValue: input.requestedValue,\n      derivedFrom: \"authenticated_actor\",\n    },\n  });\n}\n\nasync function sanitizeIssueCreateAttribution<T extends object>(\n  db: Db,\n  req: Request,\n  res: Response,\n  companyId: string,\n  input: T,\n  options: { surface: string; entityId?: string | null },\n) {\n  const sanitized = { ...input } as T & Record<string, unknown>;\n  if (req.actor.type !== \"agent\") return sanitized;\n","sourceCodeStart":603,"sourceCodeEnd":639,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/issues.ts#L603-L639","documentation":"403 from the agent input sanitizer: agents are not allowed to set a human responsible user when creating issues; the field was stripped and an attribution-spoof audit event was recorded before rejection.","triggerScenarios":"Thrown at server/src/routes/issues.ts:591 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}