{"record":{"id":"a58c7ae8ed14138c","repo":"paperclipai/paperclip","slug":"pipeline-permission-preflight-failed","errorCode":"pipeline_permission_preflight_failed","errorMessage":"Pipeline automation assignee lacks pipelines:write on the target pipeline","messagePattern":"Pipeline automation assignee lacks pipelines:write on the target pipeline","errorType":"http","errorClass":"PipelinePermissionPreflightError","httpStatus":403,"severity":"error","filePath":"server/src/services/pipelines.ts","lineNumber":2272,"sourceCode":"    dbOrTx: PipelineDb,\n    companyId: string,\n    config: PipelineBreakdownConfig,\n  ) {\n    const targetPipeline = await getPipelineOrThrow(dbOrTx, companyId, config.targetPipelineId);\n    const targetStage = await getStageByKeyOrThrow(dbOrTx, targetPipeline.id, config.targetStageKey);\n    return { targetPipeline, targetStage };\n  }\n\n  async function assertAutomationAssigneeCanWriteTargetPipeline(input: {\n    companyId: string;\n    principalId: string | null;\n    caseId: string;\n    stageId: string;\n    automationId: string;\n    targetPipelineId: string;\n  }) {\n    if (!input.principalId) {\n      throw new PipelinePermissionPreflightError({\n        ...input,\n        principalId: \"unassigned\",\n        permissionKey: PIPELINE_WRITE_PERMISSION,\n        reason: \"missing_assignee\",\n        explanation: \"Pipeline automation has no routine assignee to authorize target-pipeline writes.\",\n      });\n    }\n    const decision = await authorization.decide({\n      actor: {\n        type: \"agent\",\n        agentId: input.principalId,\n        companyId: input.companyId,\n        source: \"agent_key\",\n      },\n      action: PIPELINE_WRITE_PERMISSION,\n      resource: { type: \"company\", companyId: input.companyId },\n      scope: { pipelineId: input.targetPipelineId },\n    });","sourceCodeStart":2254,"sourceCodeEnd":2290,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/pipelines.ts#L2254-L2290","documentation":"Permission guard run when a pipeline automation executes: the principal (agent/board identity) linked to the automation does not hold pipelines:write on the pipeline the automation targets. Fires to prevent automations from escalating privileges beyond their actor's grants; the automation's principalId/targetPipelineId pair is at fault.","triggerScenarios":"Thrown at server/src/services/pipelines.ts:2272 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Grant the automation assignee pipelines:write permission on the target pipeline, or choose an assignee that has it."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}