{"record":{"id":"ae764a099eaa8532","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-ae764a","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/queues/operations/runJobs/index.ts","lineNumber":112,"sourceCode":"    req: {\n      payload,\n      payload: {\n        config: { jobs: jobsConfig },\n      },\n    },\n    sequential,\n    silent = false,\n    where: whereFromProps,\n  } = args\n\n  if (!overrideAccess) {\n    /**\n     * By default, jobsConfig.access.run will be `defaultAccess` which is a function that returns `true` if the user is logged in.\n     */\n    const accessFn = jobsConfig?.access?.run ?? (() => true)\n    const hasAccess = await accessFn({ req })\n    if (!hasAccess) {\n      throw new Forbidden(req.t)\n    }\n  }\n  const now = getCurrentDate()\n  const { duration: processingLeaseDuration, safetyBuffer: processingLeaseSafetyBuffer } =\n    jobsConfig.processingLease\n  const nowISOString = now.toISOString()\n  const processingUntil = new Date(now.getTime() + processingLeaseDuration).toISOString()\n  const processingToken = uuid()\n  const and: Where[] = [\n    {\n      completedAt: {\n        exists: false,\n      },\n    },\n    {\n      hasError: {\n        not_equals: true,\n      },","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/queues/operations/runJobs/index.ts#L94-L130","documentation":"Thrown by the `runJobs` operation when `overrideAccess` is not false and `jobsConfig.access.run` returns false. Default run access allows logged-in users. This guards the worker that claims and executes queued jobs (it acquires a processing token/lease).","triggerScenarios":"Triggering job execution (e.g. hitting the `/api/payload-jobs/run` endpoint, or calling runJobs) with an unauthenticated request or a user denied by `access.run`.","commonSituations":"A cron/worker hitting the run endpoint without an auth token; custom run access that excludes the worker principal; running jobs in a serverless function that lost the auth context.","solutions":["Authenticate the worker/cron request (default access requires a logged-in user).","Set `jobsConfig.access.run` to allow the worker principal.","Invoke runJobs with `overrideAccess: true` from a trusted worker context."],"exampleFix":"// before\n// cron hits /api/payload-jobs/run with no auth -> Forbidden\n\n// after\njobs: { access: { run: ({ req: { user } }) => Boolean(user) || isCronRequest } }","handlingStrategy":"validation","validationCode":"// worker entrypoint\nif (!req.user && !isCronToken(req)) {\n  throw new Error('run requires auth or a recognized worker principal')\n}\n\nawait runJobs({ req, overrideAccess: isCronToken(req) })","typeGuard":"import type { PayloadRequest, User } from 'payload'\n\nfunction isWorkerPrincipal(req: PayloadRequest): req is PayloadRequest & { user: User } {\n  return Boolean(req.user) || isCronToken(req)\n}\n\nif (!isWorkerPrincipal(req)) throw new Error('worker auth required')","tryCatchPattern":"try {\n  await runJobs({ req })\n} catch (err) {\n  if (err.statusCode === 403) {\n    // authenticate the worker / cron, or set overrideAccess: true\n  } else throw err\n}","preventionTips":["Give the worker/cron a dedicated authenticated principal.","Set jobs.access.run to allow that principal, or invoke with overrideAccess: true.","Smoke-test the run endpoint in CI with the worker token."],"tags":["jobs","queues","authorization","worker"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}