{"record":{"id":"f10561d43eec43c4","repo":"nanocoai/nanoclaw","slug":"delivery-action-denied-by-guard","errorCode":null,"errorMessage":"Delivery action denied by guard","messagePattern":"Delivery action denied by guard","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/delivery-guard.ts","lineNumber":54,"sourceCode":" */\nexport async function runGuarded(\n  action: string,\n  spec: DeliveryGuardSpec,\n  handler: GuardedDeliveryHandler,\n  content: Record<string, unknown>,\n  session: Session,\n  grant: PendingApproval | null,\n): Promise<void> {\n  if (spec.precheck && !(await spec.precheck(content, session))) return;\n\n  const decision = await guard(spec.guardAction, {\n    actor: { kind: 'agent', agentGroupId: session.agent_group_id, sessionId: session.id },\n    payload: content,\n    grant,\n  });\n\n  if (decision.effect === 'deny') {\n    log.warn('Delivery action denied by guard', { action, reason: decision.reason });\n    await spec.onDeny?.(content, session, decision.reason);\n    return;\n  }\n  if (decision.effect === 'hold') {\n    await spec.requestHold(content, session);\n    return;\n  }\n  await handler(content, session);\n}\n","sourceCodeStart":36,"sourceCodeEnd":64,"githubUrl":"https://github.com/nanocoai/nanoclaw/blob/294ef2aee85218b23ad30eda9dfe10e590b54a8c/src/delivery-guard.ts#L36-L64","documentation":"A privileged delivery action (e.g. schedule, approval, self-mod) was evaluated by the guard seam and explicitly denied. The message is dropped after `spec.onDeny` runs; this is a policy decision, not a crash.","triggerScenarios":"`runGuarded` calls `guard(action, input)` with the session's agent identity and the guard returns `{effect:'deny', reason}` — e.g. an agent tries a CLI-scoped or cross-group action its `cli_scope` or role does not permit.","commonSituations":"Agent attempts a privileged action (self-mod, cross-group delivery, approval replay) without owner/admin grant; a tightened permissions policy or `cli_scope: disabled|group` rejecting the call.","solutions":["Check the guard reason in the same log line to see which rule denied","Grant the needed role/permission (`ncl roles grant`, members add) or widen `cli_scope` appropriately","If the denial is wrong, fix the rule in `src/guard/` module-edge adapters"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if (decision.effect === 'deny') { /* read decision.reason; degrade gracefully, inform the user */ }","preventionTips":["Grant scoped admin/member roles before asking agents to do privileged actions","Check `ncl roles list` and cli_scope for the group up front","Handle deny in the calling agent flow instead of retrying blindly"],"tags":["guard","permissions","delivery","authorization"],"backgroundTag":"action-denied-by-policy","analyzedSha":"294ef2aee85218b23ad30eda9dfe10e590b54a8c","analyzedAt":"2026-08-28T13:59:10.357Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}