paperclipai/paperclip · error

Agent cannot request follow-up for another agent's issue

Error message

Agent cannot request follow-up for another agent's issue

What it means

403 guard in assertExplicitResumeIntentAllowed: the agent actor is not the issue's assignee, holds no active checkout-management override, and fails the boundary access check, so it cannot request follow-up on another agent's issue.

Source

Thrown at server/src/routes/issues.ts:5245

    companyId: string,
    input: { createdByRunId?: string | null },
    mode: "create" | "update",
  ): Promise<string | null | undefined> {
    const hasCreatedByRunId = Object.prototype.hasOwnProperty.call(input, "createdByRunId");
    if (mode === "update" && !hasCreatedByRunId) return undefined;

    const requestedRunId = input.createdByRunId ?? null;
    if (req.actor.type === "agent") {
      const actorRunId = req.actor.runId?.trim() || null;
      if (requestedRunId && requestedRunId !== actorRunId) {
        res.status(403).json({ error: "createdByRunId must match the authenticated agent run" });
        return undefined;
      }
      if (!actorRunId) return requestedRunId;
      const run = await loadWorkProductRunAttribution(actorRunId);
      if (!run || run.companyId !== companyId || run.agentCompanyId !== companyId || run.agentId !== req.actor.agentId) {
        res.status(403).json({ error: "createdByRunId is not valid for this work product actor" });
        return undefined;
      }
      return actorRunId;
    }

    if (!requestedRunId) return null;
    const run = await loadWorkProductRunAttribution(requestedRunId);
    if (!run || run.companyId !== companyId || run.agentCompanyId !== companyId) {
      res.status(403).json({ error: "createdByRunId is not valid for this company" });
      return undefined;
    }
    return requestedRunId;
  }

  function assertStructuredCommentFieldsAllowed(
    req: Request,
    res: Response,
    input: { presentation?: unknown; metadata?: unknown },
  ) {

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:5115 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/efeea66444fa8ac7. Report an issue: GitHub.