What causes "Only the workspace owner can delete this organization." in different-ai/openwork?

Have the current workspace owner perform the deletion.

Only the workspace owner can delete this organization.

Error message

Only the workspace owner can delete this organization.

What it means

ensureCanDeleteOrganization throws 'Only the workspace owner can delete this organization.' when canDeleteOrganization is false in getOrgAccessFlags — only the canonical owner (and super-admins per the flags implementation) may delete. It gates deleteOrganization.

Source

Thrown at ee/apps/den-web/app/(den)/dashboard/_providers/org-dashboard-provider.tsx:127

  }

  function getCurrentAccess() {
    return getOrgAccessFlags(
      orgContext?.currentMember.role ?? "member",
      orgContext?.currentMember.isOwner ?? false,
      orgContext?.roles,
    );
  }

  function ensureCanManageSettings() {
    if (!getCurrentAccess().canManageSettings) {
      throw new Error("Only workspace owners and super-admins can change settings.");
    }
  }

  function ensureCanDeleteOrganization() {
    if (!getCurrentAccess().canDeleteOrganization) {
      throw new Error("Only the workspace owner can delete this organization.");
    }
  }

  function ensureRoleCanBeAssigned(role: string) {
    if (roleIncludesCanonicalRole(role, "owner")) {
      throw new Error("The owner role cannot be assigned from this action.");
    }
  }

  function ensureTargetIsNotOwner(memberId: string) {
    const target = orgContext?.members.find((member) => member.id === memberId) ?? null;
    if (target?.isOwner) {
      throw new Error("The workspace owner cannot be changed or removed from this action.");
    }
    return target;
  }

  function shouldRefreshRolesForPage(org: DenOrgSummary) {

View on GitHub (pinned to 2b7df46e8a)

Solutions

Have the current workspace owner perform the deletion.
Verify ownership transfer completed if ownership recently changed.
Check getOrgAccessFlags inputs (currentMember.role, roles) are loaded and for the correct org.
Hide the delete control unless canDeleteOrganization is true.
If deletion is organization-wide necessary, have the Den super-admin perform it via admin surface.

Example fix

// before
await deleteOrganization(orgId);
// after
if (!getCurrentAccess().canDeleteOrganization) return showForbiddenNotice();
await deleteOrganization(orgId);

Defensive patterns

Strategy: validation

Validate before calling

if (!getCurrentAccess().canDeleteOrganization) return; // hide delete control
await deleteOrganization(orgId);

Type guard

null

Try / catch

try {
  await deleteOrganization(orgId);
} catch (e) {
  if (e instanceof Error && e.message.includes("Only the workspace owner")) {
    showToast("Ask the workspace owner to delete this organization.");
  } else throw e;
}

Prevention

Render the delete action only when canDeleteOrganization is true.
Refresh access flags after ownership transfers.
Confirm org context points at the organization being deleted.
Use an explicit confirmation dialog that also re-checks the flag.

When it happens

Trigger: deleteOrganization called by an admin or member, or by an owner of a different organization, or before access flags resolve (defaults to member role -> canDeleteOrganization false).

Common situations: Admin attempting cleanup of an unused workspace, a UI showing the delete button without checking flags, super-admin operating in an org where the flag computation excludes them, or stale access flags after an ownership transfer.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/114aea05f429adf3. Report an issue: GitHub.