{"record":{"id":"b46bfc19713f3928","repo":"PrefectHQ/fastmcp","slug":"authorization-failed-for-prompt-prompt-name-i-b46bfc","errorCode":null,"errorMessage":"Authorization failed for prompt '{prompt_name}': insufficient permissions","messagePattern":"Authorization failed for prompt '(.+?)': insufficient permissions","errorType":"exception","errorClass":"AuthorizationError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/middleware/authorization.py","lineNumber":450,"sourceCode":"                f\"Authorization failed for prompt '{prompt_name}': \"\n                \"not found or not authorized\"\n            )\n\n        # Global auth check\n        token = get_access_token()\n        ctx = AuthContext(token=token, component=prompt)\n        authorized, missing = await run_auth_checks_with_shortfall(self.auth, ctx)\n        if not authorized:\n            if missing:\n                missing = self._chain_shortfall(missing, ctx, fastmcp.fastmcp)\n                raise InsufficientScopeError(\n                    missing,\n                    message=(\n                        f\"Authorization failed for prompt '{prompt_name}': \"\n                        f\"insufficient scope (required: {', '.join(missing)})\"\n                    ),\n                )\n            raise AuthorizationError(\n                f\"Authorization failed for prompt '{prompt_name}': insufficient permissions\"\n            )\n\n        return await call_next(context)\n","sourceCodeStart":432,"sourceCodeEnd":455,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/middleware/authorization.py#L432-L455","documentation":"Raised as AuthorizationError when the prompt exists and component auth denied access, but no specific missing scopes could be identified (missing was empty). The middleware cannot say what would fix it, so it reports generic 'insufficient permissions' — the denial came from an auth check that does not express a scope shortfall.","triggerScenarios":"run_auth_checks_with_shortfall returned (False, []) — e.g. a custom auth predicate/func on the prompt returned False without declaring required scopes, or a non-scope-based AuthProvider rejected the AuthContext for the prompt.","commonSituations":"Custom `auth` callable on @mcp.prompt rejecting the caller; AuthProvider denies based on claims/roles rather than scopes; token subject not in an allowlist configured on the component.","solutions":["Inspect any custom auth predicates/functions attached to the prompt and confirm why the caller's token (claims, roles, subject) fails them.","Verify the AuthProvider's allow/deny rules for this component — a role-based or claim-based denial will surface this way rather than as missing scopes.","If a scope-based rule was intended, express it as required scopes so callers get the actionable InsufficientScopeError instead."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    result = await client.get_prompt(name)\nexcept Exception as e:\n    if \"insufficient permissions\" in str(e):\n        # no scope hint available: fall back to another prompt or surface\n        # an access-request flow to the user\n        result = None\n    else:\n        raise","preventionTips":["Prefer scope-based auth on prompts so denials produce actionable 'missing scope' errors.","Document non-scope auth rules (roles/claims/allowlists) for component access.","Test each identity class against every custom auth predicate.","Include the caller's roles/claims checks in CI-level integration tests."],"tags":["authorization","prompts","access-control"],"backgroundTag":"access-denied","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}