What causes "access denied" in hyperledger/fabric?

Re-sign/resubmit the envelope with a valid identity of an authorized organization

access denied

Error message

access denied

What it means

verifyRequest evaluates the request's creator signature against the channel's AccessController policy. If the policy evaluation fails — the envelope signature does not verify or the creator is not authorized to submit on this channel — the error is wrapped as "access denied".

Source

Thrown at orderer/consensus/smartbft/verifier.go:171

	})
}

// VerifyRequest verifies raw request
func (v *Verifier) VerifyRequest(rawRequest []byte) (types.RequestInfo, error) {
	return v.verifyRequest(rawRequest, false)
}

func (v *Verifier) verifyRequest(rawRequest []byte, noConfigAllowed bool) (types.RequestInfo, error) {
	req, err := v.ReqInspector.unwrapReq(rawRequest)
	if err != nil {
		return types.RequestInfo{}, err
	}

	err = v.AccessController.Evaluate([]*protoutil.SignedData{
		{Identity: req.sigHdr.Creator, Data: req.envelope.Payload, Signature: req.envelope.Signature},
	})
	if err != nil {
		return types.RequestInfo{}, errors.Wrap(err, "access denied")
	}

	if noConfigAllowed && req.chHdr.Type != int32(cb.HeaderType_ENDORSER_TRANSACTION) {
		return types.RequestInfo{}, errors.Errorf("only endorser transactions can be sent with other transactions")
	}

	if req.chHdr.ChannelId != v.Channel {
		return types.RequestInfo{}, errors.Errorf("request is for channel %s but expected channel %s", req.chHdr.ChannelId, v.Channel)
	}

	switch req.chHdr.Type {
	case int32(cb.HeaderType_CONFIG):
	case int32(cb.HeaderType_ORDERER_TRANSACTION):
		return types.RequestInfo{}, fmt.Errorf("orderer transactions are not supported in v3")
	case int32(cb.HeaderType_ENDORSER_TRANSACTION):
	default:
		return types.RequestInfo{}, errors.Errorf("transaction of type %s is not allowed to be included in blocks", cb.HeaderType_name[req.chHdr.Type])
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

Re-sign/resubmit the envelope with a valid identity of an authorized organization
Verify the client's MSP is included in the channel's ACL/policy for delivering transactions
Check certificate expiry and CRLs; re-enroll if the cert is expired or revoked
Ensure the envelope payload was not modified after signing (rebuild with the SDK)
Confirm the client targets the intended channel

Defensive patterns

Strategy: try-catch

Validate before calling

sd := &protoutil.SignedData{Identity: creator, Data: payload, Signature: sig}
if err := accessController.Evaluate([]*protoutil.SignedData{sd}); err != nil {
    return fmt.Errorf("client not authorized: %w", err)
}

Try / catch

if _, err := VerifyRequest(req); err != nil {
    if strings.Contains(err.Error(), "access denied") {
        // re-sign envelope with an authorized identity and resubmit
    }
}

Prevention

Use an identity whose org is a channel member
Check channel ACLs/writers policy before submitting
Re-enroll before certificates expire

When it happens

Trigger: Submitting an envelope with an invalid or missing signature; creator identity not a member/authorized principal of the channel; envelope bytes tampered with after endorsement.

Common situations: Client using an identity from another org/MSP not allowed on the channel; expired or revoked certificates; corrupted envelope during transport; wrong channel targeted by a client.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/627b0d50dcdd45d8. Report an issue: GitHub.