{"record":{"id":"e3369e99d266beb2","repo":"n8n-io/n8n","slug":"user-denied-access-to-resource-toolgroup-res","errorCode":null,"errorMessage":"User denied access to ${resource.toolGroup}: ${resource.resource}","messagePattern":"User denied access to (.+?): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/@n8n/computer-use/src/gateway-client.ts","lineNumber":541,"sourceCode":"\t\t\t}\n\n\t\t\tswitch (resolvedDecision) {\n\t\t\t\tcase 'allowOnce':\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'allowForSession':\n\t\t\t\t\tsession.allowForSession(resource.toolGroup, resource.resource);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'alwaysAllow':\n\t\t\t\t\tsession.alwaysAllow(resource.toolGroup, resource.resource);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'alwaysDeny':\n\t\t\t\t\tsession.alwaysDeny(resource.toolGroup, resource.resource);\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`User permanently denied access to ${resource.toolGroup}: ${resource.resource}`,\n\t\t\t\t\t);\n\t\t\t\tdefault:\n\t\t\t\tcase 'denyOnce':\n\t\t\t\t\tthrow new Error(`User denied access to ${resource.toolGroup}: ${resource.resource}`);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async postResponse(requestId: string, result: CallToolResult): Promise<void> {\n\t\tconst url = `${this.options.url}/rest/instance-ai/gateway/response/${requestId}`;\n\t\ttry {\n\t\t\tconst headers = new Headers();\n\t\t\theaders.set('Content-Type', 'application/json');\n\t\t\theaders.set('X-Gateway-Key', this.apiKey);\n\t\t\tconst response = await fetch(url, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({ result }),\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\tlogger.error('Failed to post response', { requestId, status: response.status });","sourceCodeStart":523,"sourceCodeEnd":559,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/computer-use/src/gateway-client.ts#L523-L559","documentation":"Thrown by checkPermissions() when the user's interactive decision resolves to 'denyOnce' or falls through to the default case. Unlike 'alwaysDeny', no session rule is persisted — the user only denied this single invocation. The tool call is aborted but future requests for the same resource will trigger a fresh prompt.","triggerScenarios":"The user is prompted for resource access and selects 'denyOnce', or dismisses/declines the prompt without choosing a persistent option.","commonSituations":"User temporarily declines access to a resource they may allow later, or the agent's request lacked sufficient context for the user to confidently approve.","solutions":["Retry the tool call to trigger a fresh confirmation prompt","Provide more context to the user about why the resource access is needed","Suggest the user choose 'allowForSession' if repeated access is expected"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isTemporaryDenyError(e: unknown): boolean {\n  return e instanceof Error && e.message.startsWith('User denied access to');\n}","tryCatchPattern":"try {\n  return await gatewayClient.callTool(name, args);\n} catch (e) {\n  if (e instanceof Error && e.message.startsWith('User denied access to')) {\n    // One-time deny — no session rule persisted. Can retry to re-prompt.\n    return { error: 'User declined access. Retry to prompt again.' };\n  }\n  throw e;\n}","preventionTips":["Provide sufficient context about why the resource is needed before prompting","Retry the tool call if the deny was one-time (denyOnce) and the context has changed","Distinguish between 'User denied access' (one-time) and 'User permanently denied' (persistent) in error handling"],"tags":["permissions","computer-use"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}