{"record":{"id":"966eea591280d763","repo":"BoundaryML/baml","slug":"access-error-message","errorCode":null,"errorMessage":"access error: {message}","messagePattern":"access error: (.+?)","errorType":"exception","errorClass":"VmBamlError","httpStatus":null,"severity":"error","filePath":"baml_language/crates/bex_vm_types/src/errors.rs","lineNumber":131,"sourceCode":"    #[error(\"invalid argument: {message}\")]\n    InvalidArgument { message: String },\n\n    #[error(\"parse error: {message}\")]\n    ParseError { message: String },\n\n    #[error(\"I/O error: {message}\")]\n    Io { message: String },\n\n    #[error(\"timeout: {message}\")]\n    Timeout {\n        message: String,\n        duration_ms: Option<i64>,\n    },\n\n    #[error(\"unsupported: {message}\")]\n    Unsupported { message: String },\n\n    #[error(\"access error: {message}\")]\n    AccessError { message: String },\n\n    #[error(\"render prompt: {message}\")]\n    RenderPrompt { message: String },\n\n    #[error(\"LLM client error: {message}\")]\n    LlmClient { message: String },\n\n    /// An error value from the host language that has no direct BAML\n    /// representation. The `handle` is the load-bearing field — it\n    /// references the original host exception object via the\n    /// process-global host-value table, so the originating runtime can\n    /// recover the exact native exception on round-trip. The\n    /// `class_name` / `message` / `language` / `traceback` fields are\n    /// purely metadata for debugging, logging, and user-facing\n    /// formatting — they do not participate in error matching or\n    /// rehydration.\n    ///","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/bex_vm_types/src/errors.rs#L113-L149","documentation":"An error value from the BAML standard library, mapping to the `baml.errors.AccessError` class. It represents a permission/access failure when a stdlib operation attempts to use a resource the caller is not permitted to access — the access was checked and denied, distinct from the resource not existing.","triggerScenarios":"Calling stdlib file/host operations on a resource the runtime lacks permission for: unreadable file, restricted path, sandbox denying access to a resource, or OS permission errors (EACCES-like) surfaced through the host.","commonSituations":"Reading files outside an allowed sandbox root; running containers as a non-root user without volume permissions; deploying to environments where the working files are owned by another user; overly restrictive runtime policies.","solutions":["Fix permissions on the resource (chmod/chown) or run the process with an identity that has access.","Keep resource paths within the runtime's allowed roots/sandbox policy.","Catch `baml.errors.AccessError` and fall back to an accessible resource or a clear user-facing message.","Verify the deployment environment's mounts and user accounts match development assumptions."],"exampleFix":"// before\nlet cfg = fs.read(\"/etc/baml/secrets.env\"); // may be denied\n// after\nlet cfg = match (try fs.read(\"/etc/baml/secrets.env\")) {\n  ok(v) => v,\n  err(e: baml.errors.AccessError) => fs.read(\"./local.env\")\n};\n","handlingStrategy":"try-catch","validationCode":"// BAML: verify access before reading\nif !fs.can_read(path) {\n  return err(\"no permission for: \" + path);\n}","typeGuard":null,"tryCatchPattern":"try {\n  let data = fs.read(path);\n} catch e: baml.errors.AccessError {\n  return accessible_alternative() ?? fail_with_message(e.message);\n}","preventionTips":["Keep application files within the sandbox/allowed roots.","Set correct ownership/permissions before deployment.","Run containers with a user that owns or can read the mounted volumes.","Review sandbox policies when adding new file or host resource accesses."],"tags":["permissions","access","sandbox","filesystem","stdlib"],"backgroundTag":"permission-denied","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}