{"record":{"id":"a6bfef9780c9d033","repo":"bytedance/deer-flow","slug":"no-models-are-authorized-for-the-current-role","errorCode":null,"errorMessage":"No models are authorized for the current role.","messagePattern":"No models are authorized for the current role\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"backend/packages/harness/deerflow/agents/lead_agent/agent.py","lineNumber":233,"sourceCode":"            cb_decision = provider.authorize(AuthzRequest(principal=principal, resource=\"model\", action=\"use\", target=candidate))\n            if isinstance(cb_decision, AuthzDecision) and cb_decision.allow:\n                logger.warning(\n                    \"Model '%s' is not authorized for the current role; fallback to '%s'.\",\n                    model_name,\n                    candidate,\n                )\n                return candidate\n        except Exception:\n            logger.warning(\n                \"Authorization provider failed while checking model:use fallback for '%s'\",\n                candidate,\n                exc_info=True,\n            )\n            if authz_config.fail_closed:\n                raise ValueError(\"No models are authorized for the current role (authorization provider error).\")\n            return model_name\n    if authz_config.fail_closed:\n        raise ValueError(\"No models are authorized for the current role.\")\n    logger.warning(\"No models are authorized for the current role; fail_open allows '%s'.\", model_name)\n    return model_name\n\n\ndef _create_summarization_middleware(\n    *,\n    app_config: AppConfig | None = None,\n    run_model_name: str | None = None,\n    extensions=None,\n) -> DeerFlowSummarizationMiddleware | None:\n    \"\"\"Create and configure the summarization middleware from config.\n\n    ``run_model_name`` is the resolved run model; it is the source of truth for\n    ``model_name: null`` summarization and the explicit-summary-model fallback, so a\n    custom agent's model is used instead of ``config.models[0]``.\n    \"\"\"\n    return create_summarization_middleware(\n        app_config=app_config,","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/packages/harness/deerflow/agents/lead_agent/agent.py#L215-L251","documentation":"ValueError from the end of _authorize_model_name: the provider cleanly denied the requested model AND every candidate from filter_resources (or the allowed list was empty), so no model is authorized for this principal. Under fail_closed the run aborts; the message omits 'provider error' because the provider worked correctly and simply denied everything.","triggerScenarios":"Agent creation for a user/role whose RBAC model allowlist is empty, or that excludes both the requested model and all alternatives visible to them, with fail_closed=true.","commonSituations":"New role created without model grants; model allowlist for 'guest' role emptied by policy change; all models removed from a user's policy after a model decommission; principal id mismatch (wrong user id passed) making filter_resources return [].","solutions":["Grant the role at least one model in the authorization policy / RBAC config (e.g. allow model:use for the default model).","Verify the principal identity reaching the provider matches the role you configured (log principal inside the provider).","If model restriction is not intended for this deployment, relax the RBAC model rules or disable model-level authz.","Confirm the requested model_name matches an allowed entry exactly (case, prefix)."],"exampleFix":"# rbac policy\n# before\nroles:\n  viewer:\n    models: []\n\n# after\nroles:\n  viewer:\n    models: [\"gpt-4o-mini\"]","handlingStrategy":"validation","validationCode":"allowed = provider.filter_resources(principal, 'model', all_names)\nif not allowed:\n    raise PermissionError(f'role {principal.role} has no model grants; configure RBAC before running')","typeGuard":null,"tryCatchPattern":"try:\n    agent = create_agent(...)\nexcept ValueError as e:\n    if str(e) == 'No models are authorized for the current role.':\n        # clean policy denial — fix the role's model grants; retrying unchanged will fail again\n        raise PermissionError('ask admin to grant a model to this role') from e\n    raise","preventionTips":["Every role needs at least one model grant before users get it.","Policy-as-code review: CI asserts each role's model list intersects config.yaml models.","Distinguish clean denial (this error) from provider malfunction ('provider error' variant) in alerting."],"tags":["authz","rbac","fail-closed","model","policy"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}