{"record":{"id":"bd26fca893bafd7e","repo":"paperclipai/paperclip","slug":"forbidden-bd26fc","errorCode":null,"errorMessage":"Forbidden","messagePattern":"Forbidden","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/agents.ts","lineNumber":3926,"sourceCode":"      res.status(404).json({ error: \"Agent not found\" });\n      return;\n    }\n    await assertCanReadConfigurations(req, agent.companyId);\n    const revisions = await svc.listConfigRevisions(id);\n    res.json(revisions.map((revision) => redactConfigRevision(revision)));\n  });\n\n  router.get(\"/agents/:id/config-revisions/:revisionId\", async (req, res) => {\n    const id = req.params.id as string;\n    const revisionId = req.params.revisionId as string;\n    const agent = await svc.getById(id);\n    if (!agent) {\n      res.status(404).json({ error: \"Agent not found\" });\n      return;\n    }\n    await assertCanReadConfigurations(req, agent.companyId);\n    const revision = await svc.getConfigRevision(id, revisionId);\n    if (!revision) {\n      res.status(404).json({ error: \"Revision not found\" });\n      return;\n    }\n    res.json(redactConfigRevision(revision));\n  });\n\n  router.post(\"/agents/:id/config-revisions/:revisionId/rollback\", async (req, res) => {\n    const id = req.params.id as string;\n    const revisionId = req.params.revisionId as string;\n    const existing = await getAccessibleResource(req, res, svc.getById(id), \"Agent not found\");\n    if (!existing) return;\n    await assertCanUpdateAgent(req, existing);\n\n    const revision = await svc.getConfigRevision(id, revisionId);\n    if (!revision) {\n      res.status(404).json({ error: \"Revision not found\" });\n      return;\n    }","sourceCodeStart":3908,"sourceCodeEnd":3944,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/agents.ts#L3908-L3944","documentation":"Actor-consistency guard on PATCH /agents/:id/permissions: the caller is an agent actor, but its own agent record could not be loaded or belongs to a different company than the target agent, so the cross-boundary permission change is refused with 403.","triggerScenarios":"Thrown at server/src/routes/agents.ts:3469 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use credentials with sufficient permissions for this operation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}