{"record":{"id":"91194ca37db3b994","repo":"paperclipai/paperclip","slug":"approvals-are-outside-this-actor-s-authorization-b","errorCode":null,"errorMessage":"Approvals are outside this actor's authorization boundary","messagePattern":"Approvals are outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/approvals.ts","lineNumber":171,"sourceCode":"  }\n\n  async function requireApprovalAccess(req: Request, id: string) {\n    const approval = await svc.getById(id);\n    if (!approval || !hasCompanyAccess(req, approval.companyId)) {\n      return null;\n    }\n    assertCompanyAccess(req, approval.companyId);\n    return approval;\n  }\n\n  async function assertApprovalAccessAllowed(req: Request, res: any, companyId: string) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"company_scope:read\",\n      resource: { type: \"company\", companyId },\n    });\n    if (decision.allowed) return true;\n    res.status(403).json({ error: \"Approvals are outside this actor's authorization boundary\" });\n    return false;\n  }\n\n  async function assertApprovalMutationAllowedByRunContext(req: Request, res: any, companyId: string) {\n    if (req.actor.type !== \"agent\") return true;\n    const runId = req.actor.runId?.trim();\n    if (!runId || !req.actor.agentId) return true;\n\n    const run = await db\n      .select({\n        id: heartbeatRuns.id,\n        companyId: heartbeatRuns.companyId,\n        agentId: heartbeatRuns.agentId,\n        contextSnapshot: heartbeatRuns.contextSnapshot,\n      })\n      .from(heartbeatRuns)\n      .where(eq(heartbeatRuns.id, runId))\n      .then((rows) => rows[0] ?? null);","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/paperclipai/paperclip/blob/5716fe907e596ce73501408fc6efdb19fb61edf2/server/src/routes/approvals.ts#L153-L189","documentation":"Error \"Approvals are outside this actor's authorization boundary\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at server/src/routes/approvals.ts:172 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Access approvals only within the actor's authorized company scope."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5716fe907e596ce73501408fc6efdb19fb61edf2","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}