{"record":{"id":"e3db2ad6ef353676","repo":"abpframework/abp","slug":"volo-authorization-010003","errorCode":"Volo.Authorization:010003","errorMessage":"Authorization failed! Given policy has not granted for given resource: {ResourceName}","messagePattern":"Authorization failed! Given policy has not granted for given resource: (.+?)","errorType":"exception","errorClass":"AbpAuthorizationException","httpStatus":403,"severity":"error","filePath":"framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs","lineNumber":150,"sourceCode":"    {\n        if (!await authorizationService.IsGrantedAsync(resource, requirement))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementHasNotGrantedForGivenResource)\n                .WithData(\"ResourceName\", resource);\n        }\n    }\n\n    /// <summary>\n    /// Checks if CurrentPrincipal meets a specific authorization policy against the specified resource, throwing an <see cref=\"AbpAuthorizationException\"/> if not.\n    /// </summary>\n    /// <param name=\"authorizationService\">The <see cref=\"IAuthorizationService\"/> providing authorization.</param>\n    /// <param name=\"resource\">The resource to evaluate the policy against.</param>\n    /// <param name=\"policy\">The policy to evaluate.</param>\n    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, AuthorizationPolicy policy)\n    {\n        if (!await authorizationService.IsGrantedAsync(resource, policy))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedForGivenResource)\n                .WithData(\"ResourceName\", resource);\n        }\n    }\n\n    /// <summary>\n    /// Checks if CurrentPrincipal meets a specific authorization policy, throwing an <see cref=\"AbpAuthorizationException\"/> if not.\n    /// </summary>\n    /// <param name=\"authorizationService\">The <see cref=\"IAuthorizationService\"/> providing authorization.</param>\n    /// <param name=\"policy\">The policy to evaluate.</param>\n    public static async Task CheckAsync(this IAuthorizationService authorizationService, AuthorizationPolicy policy)\n    {\n        if (!await authorizationService.IsGrantedAsync(policy))\n        {\n            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGranted);\n        }\n    }\n\n    /// <summary>","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/abpframework/abp/blob/7ed43b1931b9df46a50c0c59148a18645641d0df/framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs#L132-L168","documentation":"Thrown by CheckAsync(this IAuthorizationService, object resource, AuthorizationPolicy policy) when IsGrantedAsync(resource, policy) is false. Error code Volo.Authorization:010003 (GivenPolicyHasNotGrantedForGivenResource), ResourceName attached as data. This is the resource-scoped compiled-policy variant: a policy evaluated against a specific resource instance.","triggerScenarios":"Calling authorizationService.CheckAsync(resource, compiledPolicy) where the policy's requirements, evaluated against that resource, do not succeed for the current principal.","commonSituations":"Policy combines multiple requirements and one fails for the resource; resource instance is from a different tenant/owner; policy built from the wrong requirements; handler registered as a non-resource handler so it never matches.","solutions":["Verify each requirement in the policy has a matching resource-aware AuthorizationHandler that can Succeed.","Confirm the resource instance matches the handler's TResource type and passes its checks.","Check current principal claims/tenant context against what the handler requires.","Split the policy to isolate which requirement is failing."],"exampleFix":"// before\nvar policy = new AuthorizationPolicyBuilder().RequireRole(\"Editor\").Build();\nawait AuthorizationService.CheckAsync(doc, policy); // throws 010003\n// after: ensure user is Editor AND owns doc via a combined handler","handlingStrategy":"validation","validationCode":"if (!await authorizationService.IsGrantedAsync(resource, compiledPolicy))\n{\n    // return 403 for this resource instead of throwing\n}","typeGuard":"null","tryCatchPattern":"try { await authorizationService.CheckAsync(resource, policy); }\ncatch (AbpAuthorizationException ex) when (ex.Code == \"Volo.Authorization:010003\")\n{ /* handle forbidden for this resource/policy */ }","preventionTips":["Ensure each requirement in the policy has a resource-aware handler.","Confirm the resource type matches the handler's TResource.","Test policies requirement-by-requirement to isolate failures.","Prefer named policies for simpler diagnostics where possible."],"tags":["authorization","abp","security","resource","policy"],"backgroundTag":null,"analyzedSha":"7ed43b1931b9df46a50c0c59148a18645641d0df","analyzedAt":"2026-08-13T16:26:11.351Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}