{"record":{"id":"9779eb8322fcb4c2","repo":"paperclipai/paperclip","slug":"costs-are-outside-this-actor-s-authorization-bound","errorCode":null,"errorMessage":"Costs are outside this actor's authorization boundary","messagePattern":"Costs are outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/costs.ts","lineNumber":82,"sourceCode":"  const issues = issueService(db);\n  const access = accessService(db);\n\n  async function resolveIssueByRef(rawId: string) {\n    const identifier = normalizeIssueIdentifier(rawId);\n    if (identifier) {\n      return issues.getByIdentifier(identifier);\n    }\n    return issues.getById(rawId);\n  }\n\n  async function assertCompanyCostReadAllowed(req: Parameters<typeof assertCompanyAccess>[0], res: any, companyId: string) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"company_scope:read\",\n      resource: { type: \"company\", companyId },\n    });\n    if (decision.allowed) return true;\n    res.status(403).json({ error: \"Costs are outside this actor's authorization boundary\" });\n    return false;\n  }\n\n  async function assertIssueCostReadAllowed(req: Parameters<typeof assertCompanyAccess>[0], res: any, issue: {\n    id: string;\n    companyId: string;\n    projectId: string | null;\n    parentId: string | null;\n    assigneeAgentId: string | null;\n    assigneeUserId: string | null;\n    status: string;\n  }) {\n    const decision = await access.decide({\n      actor: req.actor,\n      action: \"issue:read\",\n      resource: {\n        type: \"issue\",\n        companyId: issue.companyId,","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/routes/costs.ts#L64-L100","documentation":"Error \"Costs are outside this actor's authorization boundary\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at server/src/routes/costs.ts:82 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}