paperclipai/paperclip · error · ToolGatewayHttpError

accessDecision.explanation

Error message

accessDecision.explanation

What it means

Not a literal throw message: this is the audit details block written on tool_gateway.call_denied, where the access policy decision is recorded. The referenced field is accessDecision.explanation — the policy engine's human-readable denial reason (which policy matched and why), persisted alongside decision, reasonCode, and matchedPolicyIds for each denied call.

Source

Thrown at server/src/services/tool-gateway.ts:5984

    let phase: ToolConnectionTestCallStatusPhase;
    if (actionRequest.status === "rejected") {
      phase = "denied";
    } else if (actionRequest.status === "cancelled") {
      phase = "cancelled";
    } else if (actionRequest.status === "expired") {
      phase = "expired";
    } else if (actionRequest.status === "approved" || actionRequest.status === "executed") {
      phase = invocationDone ? "done" : "running";
    } else {
      phase = "waiting";
    }

    // Recover a redacted, structured snapshot of the parameters for the
    // "Where" row — the test-call response never echoes them back.
    let parameters: Record<string, unknown> | null = null;
    const signed = readSignedToolArgumentsPayload({
      signedArguments: actionRequest.signedArguments,
      invocationId: invocation.id,
      toolName: invocation.toolName,
      signingSecret: options.toolActionSigningSecret,
    });
    if (signed && signed.arguments && typeof signed.arguments === "object" && !Array.isArray(signed.arguments)) {
      const redacted = validateToolContent({
        value: signed.arguments,
        direction: "arguments",
        sensitiveMode: "redact",
        promptInjectionMode: "ignore",
      }).value;
      if (redacted && typeof redacted === "object" && !Array.isArray(redacted)) {
        parameters = redacted as Record<string, unknown>;
      }
    }

    let result: unknown;
    let error: ToolConnectionTestCallStatus["error"];

View on GitHub (pinned to 01ad858492)

Solutions

1. Access was denied by policy; read the decision explanation for the specific reason and adjust the request (scope, tool, or arguments) accordingly.

When it happens

Trigger: Thrown at server/src/services/tool-gateway.ts:5797 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/37756fcbf3cf43fc. Report an issue: GitHub.