hasura/graphql-engine · error · ArgumentPresetExecutionError

command permissions for command {command_name} not found for

Error message

command permissions for command {command_name} not found for role {role}

What it means

CommandArgumentPresetsNotFound is thrown when the planner cannot find per-role argument presets for a command. Like the model variant, it means the role executing the command has no permissions/preset entry for that command, so argument defaults and visibility cannot be determined.

Source

Thrown at v3/crates/plan/src/query/arguments.rs:389

    GotArray {
        expected_type: QualifiedTypeReference,
    },
    #[error(
        "could not convert the provided header value to string as it contains non-visible ASCII characters"
    )]
    IllegalCharactersInHeaderValue,
    #[error("Model source not found for model '{model_name}'")]
    ModelSourceNotFound { model_name: Qualified<ModelName> },
    #[error("Model permissions for model {model_name} not found for role {role}")]
    ModelArgumentPresetsNotFound {
        role: Role,
        model_name: Qualified<ModelName>,
    },
    #[error("command {command_name} does not have a source defined")]
    CommandSourceNotFound {
        command_name: Qualified<CommandName>,
    },
    #[error("command permissions for command {command_name} not found for role {role}")]
    CommandArgumentPresetsNotFound {
        command_name: Qualified<CommandName>,
        role: Role,
    },
    #[error("argument mapping not found for {argument_name}")]
    ArgumentMappingNotFound { argument_name: ArgumentName },
    #[error("type mapping not found for object {object_type_name}")]
    TypeMappingNotFound {
        object_type_name: Qualified<CustomTypeName>,
    },
    #[error(
        "no data connector field mapping found for field '{field_name}' of object type '{object_type_name}'"
    )]
    FieldMappingNotFound {
        object_type_name: Qualified<CustomTypeName>,
        field_name: FieldName,
    },
    #[error(

View on GitHub (pinned to 724551b9ae)

Solutions

Add a permissions/preset entry for the role on the named command
Verify role name casing and the command's qualified name
Treat as an authorization failure if the role genuinely should not run the command
Reload metadata and retry

Example fix

// before
{"commands":{"usersByEmail":{"permissions":{}}}}
// after
{"commands":{"usersByEmail":{"permissions":{"admin":{"presets":{},"argumentPresets":{}}}}}}

Defensive patterns

Strategy: validation

Validate before calling

fn role_has_command_permission(metadata: &Metadata, role: &Role, cmd: &Qualified<CommandName>) -> bool {
    metadata.commands.get(cmd)
        .and_then(|c| c.permissions.as_ref())
        .map(|p| p.contains_key(role)).unwrap_or(false)
}

Type guard

fn is_command_presets_not_found(e: &ArgumentPresetExecutionError) -> bool {
    matches!(e, ArgumentPresetExecutionError::CommandArgumentPresetsNotFound { .. })
}

Try / catch

match result {
    Err(PlanError::Arguments(ArgumentPresetExecutionError::CommandArgumentPresetsNotFound { role, command_name })) => {
        respond_forbidden(format!("role {role} lacks presets for command {command_name}"));
    }
    other => other,
}

Prevention

Provision command permissions whenever adding a role
Keep role lists in one place shared by model and command permission blocks
CI-test every role x command pair that clients use

When it happens

Trigger: Executing a command under a role that lacks a command permissions entry in metadata — common when roles are introduced on the client side but not provisioned in metadata for commands (as opposed to models).

Common situations: Permissions were defined for models but not commands; a new role was added; command presets were moved to a separate metadata section in a newer version.

Related errors

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/ff5994d068f94158. Report an issue: GitHub.