paperclipai/paperclip · error · ToolGatewayHttpError

actor_company_mismatch

actor_company_mismatch

Error message

Agent key cannot access another company

What it means

executePluginTool tenancy guard: an agent-type actor attempted a plugin tool execution whose runContext.companyId differs from the actor's own companyId. The 403 enforces that agent keys can never touch another company's plugin executions, mirroring the API-key tenancy boundary.

Solutions

1. Use an agent API key scoped to the same company as the request; cross-company agent access is forbidden.

When it happens

Trigger: Thrown at server/src/services/tool-gateway.ts:6029 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@3f1d897a7c (2026-09-18). Data as JSON: /api/errors/9ecc0d1462149e7b. Report an issue: GitHub.

Appendix: source

Thrown at server/src/services/tool-gateway.ts:10525

          throw new ToolGatewayHttpError(422, message, reasonCode, {
            findings: normalizedError.findings,
          });
        }
        throw normalizedError;
      }
    },

    async executePluginTool(input: ExecutePluginToolInput) {
      if (!pluginToolDispatcher) {
        throw new ToolGatewayHttpError(
          501,
          "Plugin tool dispatch is not enabled",
          "plugin_tools_disabled",
        );
      }
      if (input.actor.type === "agent") {
        if (input.actor.companyId !== input.runContext.companyId) {
          throw new ToolGatewayHttpError(
            403,
            "Agent key cannot access another company",
            "actor_company_mismatch",
          );
        }
        if (input.actor.agentId !== input.runContext.agentId) {
          throw new ToolGatewayHttpError(
            403,
            "Agent cannot execute tools as another agent",
            "actor_agent_mismatch",
          );
        }
        if (input.actor.runId && input.actor.runId !== input.runContext.runId) {
          throw new ToolGatewayHttpError(
            403,
            "Agent cannot execute tools for another run",
            "actor_run_mismatch",
          );

View on GitHub (pinned to 3f1d897a7c)