n8n-io/n8n · warning · Error

User denied access to ${resource.toolGroup}: ${resource.reso

Error message

User denied access to ${resource.toolGroup}: ${resource.resource}

What it means

Thrown by checkPermissions() when the user's interactive decision resolves to 'denyOnce' or falls through to the default case. Unlike 'alwaysDeny', no session rule is persisted — the user only denied this single invocation. The tool call is aborted but future requests for the same resource will trigger a fresh prompt.

Source

Thrown at packages/@n8n/computer-use/src/gateway-client.ts:541

			}

			switch (resolvedDecision) {
				case 'allowOnce':
					break;
				case 'allowForSession':
					session.allowForSession(resource.toolGroup, resource.resource);
					break;
				case 'alwaysAllow':
					session.alwaysAllow(resource.toolGroup, resource.resource);
					break;
				case 'alwaysDeny':
					session.alwaysDeny(resource.toolGroup, resource.resource);
					throw new Error(
						`User permanently denied access to ${resource.toolGroup}: ${resource.resource}`,
					);
				default:
				case 'denyOnce':
					throw new Error(`User denied access to ${resource.toolGroup}: ${resource.resource}`);
			}
		}
	}

	private async postResponse(requestId: string, result: CallToolResult): Promise<void> {
		const url = `${this.options.url}/rest/instance-ai/gateway/response/${requestId}`;
		try {
			const headers = new Headers();
			headers.set('Content-Type', 'application/json');
			headers.set('X-Gateway-Key', this.apiKey);
			const response = await fetch(url, {
				method: 'POST',
				headers,
				body: JSON.stringify({ result }),
			});

			if (!response.ok) {
				logger.error('Failed to post response', { requestId, status: response.status });

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Retry the tool call to trigger a fresh confirmation prompt
2. Provide more context to the user about why the resource access is needed
3. Suggest the user choose 'allowForSession' if repeated access is expected

function isTemporaryDenyError(e: unknown): boolean {
  return e instanceof Error && e.message.startsWith('User denied access to');
}

try {
  return await gatewayClient.callTool(name, args);
} catch (e) {
  if (e instanceof Error && e.message.startsWith('User denied access to')) {
    // One-time deny — no session rule persisted. Can retry to re-prompt.
    return { error: 'User declined access. Retry to prompt again.' };
  }
  throw e;
}

When it happens

Trigger: The user is prompted for resource access and selects 'denyOnce', or dismisses/declines the prompt without choosing a persistent option.

Common situations: User temporarily declines access to a resource they may allow later, or the agent's request lacked sufficient context for the user to confidently approve.

Related errors

• User permanently denied access to ${resource.toolGroup}: ${r
• GATEWAY_CONFIRMATION_REQUIRED::${JSON.stringify({ toolGroup:
• Gateway rejected token: ${status} ${body}
• Failed to upload capabilities: ${response.status} ${text}
• Credential creation failed: ${res.status} ${text}

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/e3369e99d266beb2. Report an issue: GitHub.