{"record":{"id":"9ecc0d1462149e7b","repo":"paperclipai/paperclip","slug":"actor-company-mismatch","errorCode":"actor_company_mismatch","errorMessage":"Agent key cannot access another company","messagePattern":"Agent key cannot access another company","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":6216,"sourceCode":"        .set({\n          ...(input.body.name !== undefined ? { name: input.body.name } : {}),\n          ...(input.body.slug !== undefined || input.body.displaySlug !== undefined ? { slug: input.body.displaySlug ?? input.body.slug } : {}),\n          ...(input.body.slug !== undefined || input.body.displaySlug !== undefined ? { displaySlug: input.body.displaySlug ?? input.body.slug } : {}),\n          ...(input.body.description !== undefined ? { description: input.body.description ?? null } : {}),\n          ...(input.body.status !== undefined ? { status: input.body.status } : {}),\n          ...(input.body.profileId !== undefined ? { profileId: input.body.profileId } : {}),\n          ...(input.body.defaultProfileMode !== undefined ? { defaultProfileMode: input.body.defaultProfileMode } : {}),\n          ...(input.body.contextScopeType !== undefined ? { contextScopeType: input.body.contextScopeType } : {}),\n          ...(input.body.contextScopeId !== undefined ? { contextScopeId: input.body.contextScopeId ?? null } : {}),\n          ...(input.body.agentId !== undefined ? { agentId: input.body.agentId ?? null } : {}),\n          ...(input.body.projectId !== undefined ? { projectId: input.body.projectId ?? null } : {}),\n          ...(input.body.issueId !== undefined ? { issueId: input.body.issueId ?? null } : {}),\n          ...(input.body.approvalIssueId !== undefined ? { approvalIssueId: input.body.approvalIssueId ?? null } : {}),\n          ...(input.body.authConfig !== undefined ? { authConfig: input.body.authConfig } : {}),\n          ...(input.body.headerPolicy !== undefined ? { headerPolicy: input.body.headerPolicy } : {}),\n          ...(input.body.metadataPolicy !== undefined ? { metadataPolicy: input.body.metadataPolicy } : {}),\n          ...(input.body.onDemandToolsConfig !== undefined ? { onDemandToolsConfig: input.body.onDemandToolsConfig } : {}),\n          ...(input.body.metadata !== undefined ? { metadata: input.body.metadata ?? {} } : {}),\n          updatedAt: new Date(),\n        })\n        .where(and(eq(toolMcpGateways.companyId, input.companyId), eq(toolMcpGateways.id, input.gatewayId)))\n        .returning();\n      if (input.body.profileId && input.body.profileId !== existing.profileId) {\n        await db\n          .insert(toolProfileBindings)\n          .values({\n            companyId: input.companyId,\n            profileId: input.body.profileId,\n            targetType: \"gateway\",\n            targetId: input.gatewayId,\n            priority: 10,\n            metadata: { source: \"named_mcp_gateway\" },\n          })\n          .onConflictDoNothing();\n      }\n      return getGatewayWithTokens(input.companyId, updated.id);","sourceCodeStart":6198,"sourceCodeEnd":6234,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-gateway.ts#L6198-L6234","documentation":"executePluginTool tenancy guard: an agent-type actor attempted a plugin tool execution whose runContext.companyId differs from the actor's own companyId. The 403 enforces that agent keys can never touch another company's plugin executions, mirroring the API-key tenancy boundary.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:6029 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an agent API key scoped to the same company as the request; cross-company agent access is forbidden."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}