{"record":{"id":"b2d02d720f98c9e6","repo":"n8n-io/n8n","slug":"user-permanently-denied-access-to-resource-toolg","errorCode":null,"errorMessage":"User permanently denied access to ${resource.toolGroup}: ${resource.resource}","messagePattern":"User permanently denied access to (.+?): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/@n8n/computer-use/src/gateway-client.ts","lineNumber":501,"sourceCode":"\t\t};\n\n\t\tconst resources = await def.getAffectedResources(typedArgs, context);\n\t\tawait this.checkPermissions(resources, decision);\n\n\t\treturn await def.execute(typedArgs, context);\n\t}\n\n\tprivate async checkPermissions(\n\t\tresources: AffectedResource[],\n\t\tdecision?: ResourceDecision,\n\t): Promise<void> {\n\t\tconst { session, confirmResourceAccess, config } = this.options;\n\n\t\tfor (const resource of resources) {\n\t\t\tconst rule = session.check(resource.toolGroup, resource.resource);\n\n\t\t\tif (rule === 'deny') {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`User permanently denied access to ${resource.toolGroup}: ${resource.resource}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tif (rule === 'allow') continue;\n\n\t\t\tlet resolvedDecision: ResourceDecision;\n\n\t\t\tif (decision && config.permissionConfirmation === 'instance') {\n\t\t\t\tresolvedDecision = decision;\n\t\t\t} else if (config.permissionConfirmation === 'instance') {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`${GATEWAY_CONFIRMATION_REQUIRED_PREFIX}${JSON.stringify({\n\t\t\t\t\t\ttoolGroup: resource.toolGroup,\n\t\t\t\t\t\tresource: resource.resource,\n\t\t\t\t\t\tdescription: resource.description,\n\t\t\t\t\t\toptions: INSTANCE_RESOURCE_DECISION_KEYS,\n\t\t\t\t\t})}`,","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/computer-use/src/gateway-client.ts#L483-L519","documentation":"Thrown by checkPermissions() when session.check() returns 'deny' — the user previously chose 'alwaysDeny' for this exact toolGroup + resource combination and that decision was persisted in the gateway session. The tool call is aborted before execution begins. This is a hard deny from a prior persistent user decision, not a new prompt.","triggerScenarios":"The user previously selected 'alwaysDeny' for a resource (e.g. a specific file path or browser domain) and the same resource is requested again in the same session. The session rule short-circuits to 'deny' without prompting.","commonSituations":"User denied persistent access to a file or directory and the agent tries to access the same resource again in a later tool call within the same session.","solutions":["Reset or restart the gateway session to clear persistent deny rules","Request a different resource path that is not under a deny rule","Ask the user to re-approve access by clearing the deny rule in the session"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function isResourceDenied(session: GatewaySession, toolGroup: string, resource: string): boolean {\n  return session.check(toolGroup as ToolGroup, resource) === 'deny';\n}\n\n// Check before calling the tool:\nif (isResourceDenied(session, 'filesystemRead', resolvedPath)) {\n  throw new Error('This resource is permanently denied. Reset the session to re-approve.');\n}","typeGuard":"function isPermanentDenyError(e: unknown): boolean {\n  return e instanceof Error && e.message.startsWith('User permanently denied access to');\n}","tryCatchPattern":"try {\n  await gatewayClient.callTool(name, args);\n} catch (e) {\n  if (e instanceof Error && e.message.startsWith('User permanently denied access to')) {\n    // Session has a persistent deny rule. Reset session or use a different resource.\n    session.reset(); // clear persistent rules\n  } else {\n    throw e;\n  }\n}","preventionTips":["Check session.check() for known resources before invoking tools","Reset the gateway session when switching tasks to clear stale deny rules","Track which resources the user has permanently denied to avoid redundant attempts"],"tags":["permissions","security","computer-use"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}