{"record":{"id":"ad9db9271d3227ed","repo":"paperclipai/paperclip","slug":"issue-is-outside-this-actor-s-authorization-bounda","errorCode":null,"errorMessage":"Issue is outside this actor's authorization boundary","messagePattern":"Issue is outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/issues.ts","lineNumber":4072,"sourceCode":"  function isSkillTestScopedActor(req: Request) {\n    return req.actor.type === \"agent\" && req.actor.keyScope?.kind === \"skill_test\";\n  }\n\n  function taskBridgeOriginForActor(req: Request) {\n    return isTaskBridgeKeyActor(req) && req.actor.keyId\n      ? { originKind: \"task_bridge\", originId: req.actor.keyId }\n      : null;\n  }\n\n  async function assertTaskBridgeCreateAllowed(\n    req: Request,\n    companyId: string,\n    assignmentScope: TaskAssignmentAuthorizationScope,\n  ) {\n    if (!isTaskBridgeKeyActor(req)) return;\n    await assertCanAssignTasks(req, companyId, assignmentScope);\n  }\n\n  async function decideIssueAccess(\n    req: Request,\n    issue: {\n      id: string;\n      companyId: string;\n      projectId: string | null;\n      parentId: string | null;\n      assigneeAgentId: string | null;\n      assigneeUserId: string | null;\n      status: string;\n    },\n    action: \"issue:comment\" | \"issue:read\" | \"issue:mutate\",\n  ) {\n    return access.decide({\n      actor: req.actor,\n      action,\n      resource: {\n        type: \"issue\",","sourceCodeStart":4054,"sourceCodeEnd":4090,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/issues.ts#L4054-L4090","documentation":"The issue read-access check (decideIssueAccess on issue:read) denied the actor, meaning the issue is outside the actor's authorization boundary and denial copy is generated via issueWriteDenialResponse.","triggerScenarios":"Thrown at server/src/routes/issues.ts:3908 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}