{"record":{"id":"efeea66444fa8ac7","repo":"paperclipai/paperclip","slug":"agent-cannot-request-follow-up-for-another-agent-s","errorCode":null,"errorMessage":"Agent cannot request follow-up for another agent's issue","messagePattern":"Agent cannot request follow-up for another agent's issue","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/issues.ts","lineNumber":5245,"sourceCode":"    companyId: string,\n    input: { createdByRunId?: string | null },\n    mode: \"create\" | \"update\",\n  ): Promise<string | null | undefined> {\n    const hasCreatedByRunId = Object.prototype.hasOwnProperty.call(input, \"createdByRunId\");\n    if (mode === \"update\" && !hasCreatedByRunId) return undefined;\n\n    const requestedRunId = input.createdByRunId ?? null;\n    if (req.actor.type === \"agent\") {\n      const actorRunId = req.actor.runId?.trim() || null;\n      if (requestedRunId && requestedRunId !== actorRunId) {\n        res.status(403).json({ error: \"createdByRunId must match the authenticated agent run\" });\n        return undefined;\n      }\n      if (!actorRunId) return requestedRunId;\n      const run = await loadWorkProductRunAttribution(actorRunId);\n      if (!run || run.companyId !== companyId || run.agentCompanyId !== companyId || run.agentId !== req.actor.agentId) {\n        res.status(403).json({ error: \"createdByRunId is not valid for this work product actor\" });\n        return undefined;\n      }\n      return actorRunId;\n    }\n\n    if (!requestedRunId) return null;\n    const run = await loadWorkProductRunAttribution(requestedRunId);\n    if (!run || run.companyId !== companyId || run.agentCompanyId !== companyId) {\n      res.status(403).json({ error: \"createdByRunId is not valid for this company\" });\n      return undefined;\n    }\n    return requestedRunId;\n  }\n\n  function assertStructuredCommentFieldsAllowed(\n    req: Request,\n    res: Response,\n    input: { presentation?: unknown; metadata?: unknown },\n  ) {","sourceCodeStart":5227,"sourceCodeEnd":5263,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/issues.ts#L5227-L5263","documentation":"403 guard in assertExplicitResumeIntentAllowed: the agent actor is not the issue's assignee, holds no active checkout-management override, and fails the boundary access check, so it cannot request follow-up on another agent's issue.","triggerScenarios":"Thrown at server/src/routes/issues.ts:5115 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}