bitwarden/server · error · BadRequestException

One or more collections are already governed by another acce

Error message

One or more collections are already governed by another access rule.

What it means

Thrown by AccessRuleWriteValidator.ValidateCollectionsAsync (line 87) when a target collection already has its AccessRuleId FK set to a different rule. The code comment explains: deletes clear AccessRuleId and the FK forbids dangling links, so any set link points at an existing rule. For an update, only a link to a different rule conflicts; for a create (existingRuleId null), any set link conflicts.

Source

Thrown at bitwarden_license/src/Services/Pam/Services/AccessRuleWriteValidator.cs:87

        }

        var collections = await _collectionRepository.GetManyByManyIdsAsync(distinctIds);
        if (collections.Count != distinctIds.Count)
        {
            throw new BadRequestException("One or more collections could not be found.");
        }

        if (collections.Any(c => c.OrganizationId != organizationId))
        {
            throw new BadRequestException("One or more collections do not belong to this organization.");
        }

        // Deletes clear Collection.AccessRuleId and the FK forbids dangling links, so any set link points at an
        // existing rule; only a link to a different rule is a conflict. A rule being created has no id, so for it
        // any link at all conflicts.
        if (collections.Any(c => c.AccessRuleId.HasValue && c.AccessRuleId != existingRuleId))
        {
            throw new BadRequestException("One or more collections are already governed by another access rule.");
        }

        return distinctIds;
    }
}

View on GitHub (pinned to e93b962371)

Solutions

1. Remove the collection from the other access rule first (which clears Collection.AccessRuleId), then retry.
2. Check each collection's AccessRuleId before submitting: skip or unassign any already linked to another rule.
3. If reassigning, update the existing governing rule rather than creating a new one targeting the same collection.

Example fix

// before — target a collection already governed elsewhere
await _validator.ValidateAsync(orgId, rule, collectionIds);
// after — filter out governed collections or clear their link first
var collections = await _collectionRepository.GetManyByManyIdsAsync(collectionIds);
var free = collections.Where(c => !c.AccessRuleId.HasValue || c.AccessRuleId == existingRuleId)
                      .Select(c => c.Id);
await _validator.ValidateAsync(orgId, rule, free, existingRuleId);

var collections = await _collectionRepository.GetManyByManyIdsAsync(collectionIds.Distinct().ToList());
var conflicts = collections
    .Where(c => c.AccessRuleId.HasValue && c.AccessRuleId != existingRuleId)
    .Select(c => c.Id)
    .ToList();
if (conflicts.Count > 0)
    return Conflict($"Collections already governed: {string.Join(", ", conflicts)}");

try { await _validator.ValidateAsync(orgId, rule, collectionIds, existingRuleId); }
catch (BadRequestException ex) when (ex.Message.Contains("already governed"))
{ /* prompt user: reassign or remove from other rule first */ }

When it happens

Trigger: Creating a rule (existingRuleId null) targeting a collection whose AccessRuleId is already set, or updating a rule targeting a collection whose AccessRuleId points to a different rule's Id.

Common situations: Trying to attach a collection already governed by another rule; reassigning a collection without first clearing or reassigning the old rule; UI not refreshing the collection's current governance state.

Related errors

• One or more collections could not be found.
• One or more collections do not belong to this organization.
• A rule with that name already exists.
• Name is required.
• A maximum extension length is required when extensions are a

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/7b5d74883b76c0d7. Report an issue: GitHub.