{"record":{"id":"ae00f5c0858d4527","repo":"paperclipai/paperclip","slug":"agent-can-only-report-its-own-costs","errorCode":null,"errorMessage":"Agent can only report its own costs","messagePattern":"Agent can only report its own costs","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/costs.ts","lineNumber":119,"sourceCode":"        issueId: issue.id,\n        projectId: issue.projectId,\n        parentIssueId: issue.parentId,\n        assigneeAgentId: issue.assigneeAgentId,\n        assigneeUserId: issue.assigneeUserId,\n        status: issue.status,\n      },\n    });\n    if (decision.allowed) return true;\n    res.status(403).json({ error: \"Issue costs are outside this actor's authorization boundary\" });\n    return false;\n  }\n\n  router.post(\"/companies/:companyId/cost-events\", validate(createCostEventSchema), async (req, res) => {\n    const companyId = req.params.companyId as string;\n    assertCompanyAccess(req, companyId);\n\n    if (req.actor.type === \"agent\" && req.actor.agentId !== req.body.agentId) {\n      res.status(403).json({ error: \"Agent can only report its own costs\" });\n      return;\n    }\n\n    const event = await costs.createEvent(companyId, {\n      ...req.body,\n      occurredAt: new Date(req.body.occurredAt),\n    });\n\n    const actor = getActorInfo(req);\n    await logActivity(db, {\n      companyId,\n      actorType: actor.actorType,\n      actorId: actor.actorId,\n      agentId: actor.agentId,\n      action: \"cost.reported\",\n      entityType: \"cost_event\",\n      entityId: event.id,\n      details: { costCents: event.costCents, model: event.model },","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/routes/costs.ts#L101-L137","documentation":"Error \"Agent can only report its own costs\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at server/src/routes/costs.ts:119 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}