invoke-ai/InvokeAI · error · PermissionError

Queue user is not authorized to save videos to this board

Error message

Queue user is not authorized to save videos to this board

What it means

Raised in ModelsContext.save when an image/video is being saved to a board that the queue user is not permitted to write to. InvokeAI allows a save only if the queue user is an admin, owns the board (board.user_id equals the queue item's user_id), or the board is Public. Otherwise a PermissionError is thrown to prevent cross-user writes to shared boards.

Source

Thrown at invokeai/app/services/shared/invocation_context.py:412

        board_id_ = None
        if board_id:
            board_id_ = board_id
        elif isinstance(self._data.invocation, WithBoard) and self._data.invocation.board:
            board_id_ = self._data.invocation.board.board_id

        if self._services.configuration.multiuser:
            user = self._services.users.get(self._data.queue_item.user_id)
            # See ImagesInterface.save: deactivated accounts must not save outputs.
            if user is None or not user.is_active:
                raise PermissionError("Queue user is not authorized to save videos")
            if board_id_ is not None:
                board = self._services.boards.get_dto(board_id_)
                if (
                    not user.is_admin
                    and board.user_id != self._data.queue_item.user_id
                    and board.board_visibility != BoardVisibility.Public
                ):
                    raise PermissionError("Queue user is not authorized to save videos to this board")

        workflow_ = None
        if self._data.queue_item.workflow:
            workflow_ = self._data.queue_item.workflow.model_dump_json()

        graph_ = None
        if self._data.queue_item.session.graph:
            graph_ = self._data.queue_item.session.graph.model_dump_json()

        return self._services.videos.create(
            source_path=source_path,
            width=width,
            height=height,
            duration=duration,
            fps=fps,
            is_intermediate=self._data.invocation.is_intermediate,
            video_category=image_category,
            board_id=board_id_,

View on GitHub (pinned to 0b6a024f2f)

Solutions

  1. Set the board's visibility to Public so any queue user can save to it
  2. Have the queue item run under the same user that owns the board
  3. Ask an admin user to run the workflow (admins bypass the check)
  4. Use a board owned by the queue user instead of the hardcoded board_id

Example fix

// before
ctx.images.save(board_id="board-owned-by-alice")
// after
board = ctx._services.boards.get_dto("board-owned-by-alice")
assert board.board_visibility == BoardVisibility.Public or board.user_id == queue_item.user_id
ctx.images.save(board_id="board-owned-by-alice")
Defensive patterns

Strategy: validation

Validate before calling

board = services.boards.get_dto(board_id)
queue_user_is_admin = user.is_admin
owns_board = board.user_id == queue_item.user_id
if not (queue_user_is_admin or owns_board or board.board_visibility == BoardVisibility.Public):
    raise PermissionError(f"cannot save to board {board.board_id}")
ctx.images.save(image_name=image_name, board_id=board_id)

Type guard

def can_save_to_board(user, board, queue_item) -> bool:
    return user.is_admin or board.user_id == queue_item.user_id or board.board_visibility == BoardVisibility.Public

Prevention

When it happens

Trigger: Calling ctx.models.save (image/video save path) with board_id_ pointing to a board owned by a different user whose board_visibility is not Public, while the queue user is not an admin.

Common situations: Multi-user InvokeAI deployments where a workflow hardcodes another user's board ID; boards created Private/Shared by one user but referenced by another user's queue item; admin changed board visibility after a workflow was authored.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors


AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/4683beb147e40c0d. Report an issue: GitHub.