{"record":{"id":"f34edddb377b4864","repo":"home-assistant/core","slug":"unauthorized-f34edd","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":"Unauthorized","httpStatus":401,"severity":"error","filePath":"homeassistant/components/assist_satellite/__init__.py","lineNumber":119,"sourceCode":"            cv.has_at_least_one_key(\"start_message\", \"start_media_id\"),\n        ),\n        \"async_internal_start_conversation\",\n        [AssistSatelliteEntityFeature.START_CONVERSATION],\n    )\n\n    async def handle_ask_question(call: ServiceCall) -> dict[str, Any]:\n        \"\"\"Handle a Show View service call.\"\"\"\n        satellite_entity_id: str = call.data[ATTR_ENTITY_ID]\n        if call.context.user_id:\n            user = await hass.auth.async_get_user(call.context.user_id)\n            if user is None:\n                raise UnknownUser(\n                    context=call.context,\n                    permission=POLICY_CONTROL,\n                    user_id=call.context.user_id,\n                )\n            if not user.permissions.check_entity(satellite_entity_id, POLICY_CONTROL):\n                raise Unauthorized(\n                    context=call.context,\n                    permission=POLICY_CONTROL,\n                    user_id=call.context.user_id,\n                    perm_category=CAT_ENTITIES,\n                )\n\n        satellite_entity: AssistSatelliteEntity | None = component.get_entity(\n            satellite_entity_id\n        )\n        if satellite_entity is None:\n            raise HomeAssistantError(\n                f\"Invalid Assist satellite entity id: {satellite_entity_id}\"\n            )\n\n        ask_question_args = {\n            \"question\": call.data.get(\"question\"),\n            \"question_media_id\": call.data.get(\"question_media_id\"),\n            \"preannounce\": call.data.get(\"preannounce\", True),","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/components/assist_satellite/__init__.py#L101-L137","documentation":"Unauthorized is Home Assistant's permission-denied error. Here it is raised when the calling user exists but their permission policy does not grant POLICY_CONTROL over the target assist_satellite entity (perm_category CAT_ENTITIES). It is the standard enforcement point for entity-scoped control permissions in a service handler.","triggerScenarios":"A non-admin user without control rights over the satellite entity calls assist_satellite.ask_question on it; a restricted user whose entity_perms policy excludes the entity's entity_id; entity_id belongs to a different area/user scope than the caller may control.","commonSituations":"Users created with limited permissions attempting voice-satellite actions; newly added satellite entity not included in the user's allowed entities; YAML admin/user permission files that were edited but not reloaded.","solutions":["Grant the calling user control permission for that entity (User settings > Permissions, or admin policy)","Run the service as a user with the control permission over assist_satellite entities","Verify the entity_id in the service call matches an entity the user is allowed to control","If using a users.yaml policy, add the entity under entity_perms > control and reload permissions"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (\n    (user := await hass.auth.async_get_user(call.context.user_id))\n    and not user.permissions.check_entity(satellite_entity_id, POLICY_CONTROL)\n):\n    _LOGGER.warning(\"User %s lacks control on %s\", user.id, satellite_entity_id)","typeGuard":null,"tryCatchPattern":"try:\n    await hass.services.async_call(\"assist_satellite\", \"ask_question\", {...})\nexcept Unauthorized:\n    # surface a permission message to the caller / pick an entity the user may control\n    raise","preventionTips":["Pre-check user.permissions.check_entity(entity_id, POLICY_CONTROL) before invoking entity-scoped services","Prefer admin users or explicit entity permission grants in users.yaml for satellite automations","After adding satellites, update restricted users' entity permission lists"],"tags":["permissions","auth","service-call","assist-satellite"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}