iflytek/astron-agent · error · BusinessException

INSUFFICIENT_PERMISSIONS

INSUFFICIENT_PERMISSIONS

Error message

BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS)

What it means

assertWorkflowExecutionScope enforces that the caller may only obtain credentials for workflows it owns. For personal workflows (spaceId null), the caller's spaceId must be null AND uid must equal the workflow owner; otherwise INSUFFICIENT_PERMISSIONS is thrown.

Solutions

1. For personal workflows, omit the spaceId parameter entirely.
2. Use the workflow owner's uid, or act as the owning user.
3. If a shared/space-scoped credential is needed, move the workflow into the space or create a space-scoped sandbox config.
4. Verify ownership before calling (compare workflow.uid to your uid).

Example fix

// before
getRuntimeCredential(token, flowId, myUid, 42L); // personal workflow, wrong spaceId
// after
getRuntimeCredential(token, flowId, workflow.getUid(), null);

if (workflow.getSpaceId() == null && (spaceId != null || !workflow.getUid().equals(uid))) {
    throw new IllegalArgumentException("Personal workflow requires owner uid and no spaceId");
}

try {
    cred = getRuntimeCredential(token, flowId, uid, spaceId);
} catch (BusinessException e) {
    if ("INSUFFICIENT_PERMISSIONS".equals(e.getCode())) fallBackToOwnerOwnedRequest();
}

When it happens

Trigger: Requesting runtime credentials with a personal workflow (workflow.spaceId == null) while passing a non-null spaceId, or passing a uid different from the workflow owner.

Common situations: A service or another user trying to fetch credentials for someone else's personal sandbox; a client incorrectly including the spaceId of the current UI context for a personal workflow.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Skill resource URL is not allowed
• exceeds size limit
• BOT_NOT_EXISTS
• EXCEED_AUTHORITY
• UNAUTHORIZED

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/3e1b4547b064ff10. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/skill/SkillSandboxConfigService.java:165

            assertWorkflowExecutionScope(workflow, uid, spaceId);
            config = getActiveConfigForTrustedScope(workflow.getUid(), workflow.getSpaceId());
        } else {
            config = getActiveConfigForTrustedScope(uid, spaceId);
        }
        if (config == null) {
            throw new BusinessException(ResponseEnum.DATA_NOT_EXIST);
        }
        return new SkillSandboxRuntimeCredentialDto(
                normalizeProvider(config.getProvider()),
                config.getApiKey(),
                normalizeTimeout(config.getTimeoutSeconds()),
                Boolean.TRUE.equals(config.getAllowInternetAccess()));
    }

    private void assertWorkflowExecutionScope(Workflow workflow, String uid, Long spaceId) {
        if (workflow.getSpaceId() == null) {
            if (spaceId != null || !StringUtils.equals(workflow.getUid(), uid)) {
                throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
            }
            return;
        }
        if (!java.util.Objects.equals(workflow.getSpaceId(), spaceId)) {
            throw new BusinessException(ResponseEnum.INSUFFICIENT_PERMISSIONS);
        }
    }

    private SkillSandboxConfig getActiveConfig(String uid, Long spaceId) {
        SkillSandboxConfig config = getScopedConfig(uid, spaceId);
        if (config == null
                || !Boolean.TRUE.equals(config.getEnabled())
                || StringUtils.isBlank(config.getApiKey())) {
            return null;
        }
        return config;
    }

View on GitHub (pinned to 5e758547a8)