paperclipai/paperclip · error

Activity is outside this actor's authorization boundary

Error message

Activity is outside this actor's authorization boundary

What it means

Authorization gate in the activity routes: the access decision for the 'company_scope:read' action on this company returned denied, meaning the actor (agent or restricted user) may not read activity at company scope. The route responds 403 rather than leaking scoped activity data.

Source

Thrown at server/src/routes/activity.ts:182

      ...result,
      items: result.items.map((item) => ({
        ...item,
        agentId: null,
        runId: null,
        responsibleUserId: null,
        details: null,
      })),
    };
  }

  async function assertCompanyScopeReadAllowed(req: Parameters<typeof assertCompanyAccess>[0], res: any, companyId: string) {
    const decision = await access.decide({
      actor: req.actor,
      action: "company_scope:read",
      resource: { type: "company", companyId },
    });
    if (decision.allowed) return true;
    res.status(403).json({ error: "Activity is outside this actor's authorization boundary" });
    return false;
  }

  async function assertIssueReadAllowed(req: Parameters<typeof assertCompanyAccess>[0], res: any, issue: {
    id: string;
    companyId: string;
    projectId: string | null;
    parentId: string | null;
    assigneeAgentId: string | null;
    assigneeUserId: string | null;
    status: string;
  }) {
    const decision = await access.decide({
      actor: req.actor,
      action: "issue:read",
      resource: {
        type: "issue",
        companyId: issue.companyId,

View on GitHub (pinned to a7e689b3c3)

Solutions

1. Request activity only for companies the actor is authorized to access.

When it happens

Trigger: Thrown at server/src/routes/activity.ts:182 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-18). Data as JSON: /api/errors/5d12431617bdb370. Report an issue: GitHub.