bytedance/deer-flow · error · ValueError

No models are authorized for the current role.

Error message

No models are authorized for the current role.

What it means

ValueError from the end of _authorize_model_name: the provider cleanly denied the requested model AND every candidate from filter_resources (or the allowed list was empty), so no model is authorized for this principal. Under fail_closed the run aborts; the message omits 'provider error' because the provider worked correctly and simply denied everything.

Source

Thrown at backend/packages/harness/deerflow/agents/lead_agent/agent.py:233

            cb_decision = provider.authorize(AuthzRequest(principal=principal, resource="model", action="use", target=candidate))
            if isinstance(cb_decision, AuthzDecision) and cb_decision.allow:
                logger.warning(
                    "Model '%s' is not authorized for the current role; fallback to '%s'.",
                    model_name,
                    candidate,
                )
                return candidate
        except Exception:
            logger.warning(
                "Authorization provider failed while checking model:use fallback for '%s'",
                candidate,
                exc_info=True,
            )
            if authz_config.fail_closed:
                raise ValueError("No models are authorized for the current role (authorization provider error).")
            return model_name
    if authz_config.fail_closed:
        raise ValueError("No models are authorized for the current role.")
    logger.warning("No models are authorized for the current role; fail_open allows '%s'.", model_name)
    return model_name


def _create_summarization_middleware(
    *,
    app_config: AppConfig | None = None,
    run_model_name: str | None = None,
    extensions=None,
) -> DeerFlowSummarizationMiddleware | None:
    """Create and configure the summarization middleware from config.

    ``run_model_name`` is the resolved run model; it is the source of truth for
    ``model_name: null`` summarization and the explicit-summary-model fallback, so a
    custom agent's model is used instead of ``config.models[0]``.
    """
    return create_summarization_middleware(
        app_config=app_config,

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Grant the role at least one model in the authorization policy / RBAC config (e.g. allow model:use for the default model).
2. Verify the principal identity reaching the provider matches the role you configured (log principal inside the provider).
3. If model restriction is not intended for this deployment, relax the RBAC model rules or disable model-level authz.
4. Confirm the requested model_name matches an allowed entry exactly (case, prefix).

Example fix

# rbac policy
# before
roles:
  viewer:
    models: []

# after
roles:
  viewer:
    models: ["gpt-4o-mini"]

allowed = provider.filter_resources(principal, 'model', all_names)
if not allowed:
    raise PermissionError(f'role {principal.role} has no model grants; configure RBAC before running')

try:
    agent = create_agent(...)
except ValueError as e:
    if str(e) == 'No models are authorized for the current role.':
        # clean policy denial — fix the role's model grants; retrying unchanged will fail again
        raise PermissionError('ask admin to grant a model to this role') from e
    raise

When it happens

Trigger: Agent creation for a user/role whose RBAC model allowlist is empty, or that excludes both the requested model and all alternatives visible to them, with fail_closed=true.

Common situations: New role created without model grants; model allowlist for 'guest' role emptied by policy change; all models removed from a user's policy after a model decommission; principal id mismatch (wrong user id passed) making filter_resources return [].

Related errors

• No models are authorized for the current role (authorization
• No chat model could be resolved. Please configure at least o
• Permission denied: {resource}:{action}
• Model '{model_name}' is not available for your role
• Model {model_name!r} is not in the configured model allowlis

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/a6bfef9780c9d033. Report an issue: GitHub.