instructure/canvas-lms · error · GraphQL::ExecutionError

insufficient permissions to create non-collaborative groups

Error message

insufficient permissions to create non-collaborative groups

What it means

CreateGroupInSet#resolve raises this ExecutionError when input[:non_collaborative] is true and the differentiation-tags feature is enabled on the account, but the set's context does not grant :manage_tags_add to the current user. Creating a differentiation-tag (non-collaborative) group requires tag-management rights in addition to :manage_groups_add.

Solutions

1. Grant :manage_tags_add to the user's role on the course/account (RoleOverrides / permissions UI).
2. Verify account.allow_assign_to_differentiation_tags? is actually intended; if not, the flag state is the issue.
3. Have a user with tag-management rights create the non-collaborative group instead.
4. In the UI, hide the 'non-collaborative' option when the user lacks manage_tags_add.

Example fix

// before: create with non_collaborative always
createGroupInSet({groupSetId, name, non_collaborative: true})

// after
const allowed = groupSet.permissions.manageTagsAdd
createGroupInSet({groupSetId, name, non_collaborative: allowed ? true : false})

if (nonCollaborative && !groupSet.permissions?.manageTagsAdd) {
  disableTagGroupOption()
}

const canCreateTagGroup = (set, user) => Boolean(set?.permissions?.manageTagsAdd)

When it happens

Trigger: Mutation createGroupInSet with non_collaborative: true executed by a teacher/admin lacking manage_tags_add on the course/account; account has allow_assign_to_differentiation_tags enabled so the permission check applies.

Common situations: Differentiation tags rollout: admins enabled the account flag but did not update role overrides to grant manage_tags_add to teachers; custom roles built before the feature lack the new permission.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• cannot create collaborative groups in a non-collaborative…
• cannot create non-collaborative groups when the…
• ActiveRecord::RecordNotFound
• custom gradebook statuses feature flag is disabled
• feature flag is disabled

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/57ae2166546e302f. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/create_group_in_set.rb:38

class Mutations::CreateGroupInSet < Mutations::BaseMutation
  graphql_name "CreateGroupInSet"

  argument :group_set_id, ID, required: true, prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func("GroupSet")
  argument :name, String, required: true
  argument :non_collaborative, Boolean, required: false, default_value: false

  field :group, Types::GroupType, null: true

  def resolve(input:)
    category_id = GraphQLHelpers.parse_relay_or_legacy_id(input[:group_set_id], "GroupSet")
    set = GroupCategory.find(category_id)
    account = (set.context_type == "Account") ? set.context : set.context&.account
    verify_authorized_action!(set.context, :manage_groups_add)

    if input[:non_collaborative]
      if account&.allow_assign_to_differentiation_tags?
        raise GraphQL::ExecutionError, "insufficient permissions to create non-collaborative groups" unless set.context&.grants_right?(current_user, session, :manage_tags_add)
      else
        raise GraphQL::ExecutionError, "cannot create non-collaborative groups when the differentiation tags feature flag is disabled"
      end
    elsif set.non_collaborative
      raise GraphQL::ExecutionError, "cannot create collaborative groups in a non-collaborative group set"
    end

    group = set.groups.build(name: input[:name], context: set.context, non_collaborative: input[:non_collaborative])

    if group.save
      { group: }
    else
      errors_for(group)
    end
  rescue ActiveRecord::RecordNotFound
    raise GraphQL::ExecutionError, "not found"
  end
end

View on GitHub (pinned to 1c9f0bb801)