{"record":{"id":"ad880fd635c5082f","repo":"paperclipai/paperclip","slug":"low-trust-agents-must-create-child-issues-inside-t","errorCode":null,"errorMessage":"Low-trust agents must create child issues inside their assigned boundary","messagePattern":"Low-trust agents must create child issues inside their assigned boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/issues.ts","lineNumber":8813,"sourceCode":"    if (!(await assertDeliverableMutationAllowedByRunContext(req, res, issue))) return;\n    const workProduct = await workProductsSvc.getById(workProductId);\n    if (!workProduct || workProduct.issueId !== issue.id || workProduct.companyId !== issue.companyId) {\n      res.status(404).json({ error: \"Work product not found\" });\n      return;\n    }\n    const actor = getActorInfo(req);\n    const result = await ensureArtifactReviewDocumentForWorkProduct({ issue, workProduct, actor });\n    res.status(result.created ? 201 : 200).json(result.document);\n  });\n\n  router.post(\"/issues/:id/low-trust/promotions\", validate(promoteLowTrustOutputSchema), async (req, res) => {\n    const id = req.params.id as string;\n    const issue = await getAccessibleResource(req, res, svc.getById(id), \"Issue not found\");\n    if (!issue) return;\n    if (!(await assertIssueReadAllowed(req, res, issue))) return;\n    if (!(await assertAgentIssueMutationAllowed(req, res, issue))) return;\n    if (!(await assertDeliverableMutationAllowedByRunContext(req, res, issue))) return;\n    const actor = getActorInfo(req);\n    if (await sourceTrustForActorWrite(issue, actor)) {\n      res.status(403).json({ error: \"Low-trust actors cannot promote quarantined output\" });\n      return;\n    }\n    const sourceTrust = await lookupLowTrustSourceArtifact({\n      issueId: issue.id,\n      artifactKind: req.body.sourceArtifactKind,\n      artifactId: req.body.sourceArtifactId,\n    });\n    if (!sourceTrust) {\n      res.status(404).json({ error: \"Low-trust source artifact not found\" });\n      return;\n    }\n    if (!isLowTrustQuarantined(sourceTrust)) {\n      res.status(422).json({ error: \"Source artifact is not quarantined low-trust output\" });\n      return;\n    }\n","sourceCodeStart":8795,"sourceCodeEnd":8831,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/issues.ts#L8795-L8831","documentation":"403 from issue creation for agents. Fires when a low-trust agent attempts to create a top-level (parentless) issue; low-trust agents may only create child issues nested inside their assigned parent boundary, not root issues.","triggerScenarios":"Thrown at server/src/routes/issues.ts:8192 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}