{"record":{"id":"c7e650e98c0476eb","repo":"paperclipai/paperclip","slug":"project-is-outside-this-actor-s-authorization-boun","errorCode":null,"errorMessage":"Project is outside this actor's authorization boundary","messagePattern":"Project is outside this actor's authorization boundary","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/projects.ts","lineNumber":115,"sourceCode":"\n  function readProjectPolicyEnvironmentId(policy: unknown): string | null | undefined {\n    if (!policy || typeof policy !== \"object\" || !(\"environmentId\" in policy)) {\n      return undefined;\n    }\n    const environmentId = (policy as { environmentId?: unknown }).environmentId;\n    return typeof environmentId === \"string\" || environmentId === null ? environmentId : undefined;\n  }\n\n  async function resolveCompanyIdForProjectReference(req: Request) {\n    const companyIdQuery = req.query.companyId;\n    const requestedCompanyId =\n      typeof companyIdQuery === \"string\" && companyIdQuery.trim().length > 0\n        ? companyIdQuery.trim()\n        : null;\n    if (requestedCompanyId) {\n      assertCompanyAccess(req, requestedCompanyId);\n      return requestedCompanyId;\n    }\n    if (req.actor.type === \"agent\" && req.actor.companyId) {\n      return req.actor.companyId;\n    }\n    return null;\n  }\n\n  async function normalizeProjectReference(req: Request, rawId: string) {\n    if (isUuidLike(rawId)) return rawId;\n    const companyId = await resolveCompanyIdForProjectReference(req);\n    if (!companyId) return rawId;\n    const resolved = await svc.resolveByReference(companyId, rawId);\n    if (resolved.ambiguous) {\n      throw conflict(\"Project shortname is ambiguous in this company. Use the project ID.\");\n    }\n    return resolved.project?.id ?? rawId;\n  }\n\n  async function assertProjectReadAllowed(req: Request, res: Response, project: { id: string; companyId: string }) {","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/projects.ts#L97-L133","documentation":"Error \"Project is outside this actor's authorization boundary\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at server/src/routes/projects.ts:105 when the library encounters an invalid state.","commonSituations":"Returned when a request attempts to access a project outside the actor's company authorization boundary, e.g. an agent API key from another company.","solutions":["Use an actor/API key that belongs to the company that owns the project.","Verify the project id in the request belongs to the caller's company; agent keys cannot cross company boundaries."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}