{"record":{"id":"c127b2bd70ac81e6","repo":"bitwarden/server","slug":"machine-account-access-must-be-can-read-write","errorCode":null,"errorMessage":"Machine account access must be Can read, write","messagePattern":"Machine account access must be Can read, write","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/SecretsManager/Models/Request/PeopleAccessPoliciesRequestModel.cs","lineNumber":71,"sourceCode":"        var groupAccessPolicies = GroupAccessPolicyRequests?\n            .Select(x => x.ToGroupServiceAccountAccessPolicy(grantedServiceAccountId, organizationId)).ToList();\n\n        var policies = new List<BaseAccessPolicy>();\n        if (userAccessPolicies != null)\n        {\n            policies.AddRange(userAccessPolicies);\n        }\n\n        if (groupAccessPolicies != null)\n        {\n            policies.AddRange(groupAccessPolicies);\n        }\n\n        AccessPolicyHelpers.CheckForDistinctAccessPolicies(policies);\n\n        if (!policies.All(ap => ap.Read && ap.Write))\n        {\n            throw new BadRequestException(\"Machine account access must be Can read, write\");\n        }\n\n        return new ServiceAccountPeopleAccessPolicies\n        {\n            Id = grantedServiceAccountId,\n            OrganizationId = organizationId,\n            UserAccessPolicies = userAccessPolicies,\n            GroupAccessPolicies = groupAccessPolicies\n        };\n    }\n}\n","sourceCodeStart":53,"sourceCodeEnd":83,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/SecretsManager/Models/Request/PeopleAccessPoliciesRequestModel.cs#L53-L83","documentation":"Thrown by ToServiceAccountPeopleAccessPolicies when at least one access policy in the request does not have both Read=true AND Write=true. Service account people (user/group) access policies must be full read-write — partial or read-only access is not permitted when assigning people to a service account. The guard is !policies.All(ap => ap.Read && ap.Write).","triggerScenarios":"POST/PUT to a service-account people access policies endpoint where any user or group access policy request has Read=false or Write=false (e.g., setting a group to read-only on a service account).","commonSituations":"UI or API client reuses project-access-policy patterns (which allow read-only) for service-account assignments; importing access policy templates that set Read=true, Write=false.","solutions":["Set both Read=true and Write=true on every user and group access policy in the request body.","If read-only access is truly needed, note that service account people policies do not support it — redesign the access model.","Validate all policy entries client-side before submission to ensure both flags are true."],"exampleFix":"// before: read-only policy rejected\n{\n  \"groupAccessPolicyRequests\": [{\n    \"groupId\": \"...\",\n    \"read\": true,\n    \"write\": false\n  }]\n}\n// after: both read and write required\n{\n  \"groupAccessPolicyRequests\": [{\n    \"groupId\": \"...\",\n    \"read\": true,\n    \"write\": true\n  }]\n}","handlingStrategy":"validation","validationCode":"// Validate all service-account people policies are read+write before submitting\nvar allPolicies = userPolicies.Concat(groupPolicies);\nif (!allPolicies.All(ap => ap.Read && ap.Write))\n{\n    return BadRequest(\"All service account people access must be Read=true and Write=true.\");\n}\nawait client.SetServiceAccountPeoplePoliciesAsync(serviceAccountId, request);","typeGuard":"static bool IsValidServiceAccountPeoplePolicy(AccessPolicyRequest p) => p.Read && p.Write;","tryCatchPattern":"try { await client.SetPoliciesAsync(id, req); }\ncatch (ApiException ex) when (ex.Message.Contains(\"Can read, write\"))\n{\n    // Fix all policies to read+write and retry\n    req.UserAccessPolicyRequests.ForEach(p => { p.Read = true; p.Write = true; });\n    await client.SetPoliciesAsync(id, req);\n}","preventionTips":["Default service-account people policy forms to Read=true, Write=true.","Do not allow unchecking Read or Write for service-account people assignments.","Validate on the client that every policy has both flags true before submit."],"tags":["secrets-manager","access-policies","validation","service-accounts","bitwarden"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}