{"record":{"id":"9ecc0d1462149e7b","repo":"paperclipai/paperclip","slug":"actor-company-mismatch","errorCode":"actor_company_mismatch","errorMessage":"Agent key cannot access another company","messagePattern":"Agent key cannot access another company","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":10525,"sourceCode":"          throw new ToolGatewayHttpError(422, message, reasonCode, {\n            findings: normalizedError.findings,\n          });\n        }\n        throw normalizedError;\n      }\n    },\n\n    async executePluginTool(input: ExecutePluginToolInput) {\n      if (!pluginToolDispatcher) {\n        throw new ToolGatewayHttpError(\n          501,\n          \"Plugin tool dispatch is not enabled\",\n          \"plugin_tools_disabled\",\n        );\n      }\n      if (input.actor.type === \"agent\") {\n        if (input.actor.companyId !== input.runContext.companyId) {\n          throw new ToolGatewayHttpError(\n            403,\n            \"Agent key cannot access another company\",\n            \"actor_company_mismatch\",\n          );\n        }\n        if (input.actor.agentId !== input.runContext.agentId) {\n          throw new ToolGatewayHttpError(\n            403,\n            \"Agent cannot execute tools as another agent\",\n            \"actor_agent_mismatch\",\n          );\n        }\n        if (input.actor.runId && input.actor.runId !== input.runContext.runId) {\n          throw new ToolGatewayHttpError(\n            403,\n            \"Agent cannot execute tools for another run\",\n            \"actor_run_mismatch\",\n          );","sourceCodeStart":10507,"sourceCodeEnd":10543,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/services/tool-gateway.ts#L10507-L10543","documentation":"executePluginTool tenancy guard: an agent-type actor attempted a plugin tool execution whose runContext.companyId differs from the actor's own companyId. The 403 enforces that agent keys can never touch another company's plugin executions, mirroring the API-key tenancy boundary.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:6029 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an agent API key scoped to the same company as the request; cross-company agent access is forbidden."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-09-18T08:03:59.046Z","contentChangedAt":"2026-09-18T08:03:59.046Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}