paperclipai/paperclip · error

Agent-created issues cannot set responsibleUserId

Error message

Agent-created issues cannot set responsibleUserId

What it means

403 from the agent input sanitizer: agents are not allowed to set a human responsible user when creating issues; the field was stripped and an attribution-spoof audit event was recorded before rejection.

Source

Thrown at server/src/routes/issues.ts:621

  issue: { id: string; companyId: string; identifier: string | null };
  surface: "issue.comment.create" | "issue.patch.comment";
  requestedValue: string | null;
}) {
  const actor = getActorInfo(input.req);
  await logActivity(input.db, {
    companyId: input.issue.companyId,
    actorType: actor.actorType,
    actorId: actor.actorId,
    agentId: actor.agentId,
    runId: actor.runId,
    agentApiKeyId: actor.agentApiKeyId,
    responsibleUserIdOverride: authenticatedActorResponsibleUserId(input.req),
    action: "issue.attribution_spoof_rejected",
    entityType: "issue",
    entityId: input.issue.id,
    details: {
      identifier: input.issue.identifier,
      surface: input.surface,
      field: "onBehalfOfUserId",
      requestedValue: input.requestedValue,
      derivedFrom: "authenticated_actor",
    },
  });
}

async function sanitizeIssueCreateAttribution<T extends object>(
  db: Db,
  req: Request,
  res: Response,
  companyId: string,
  input: T,
  options: { surface: string; entityId?: string | null },
) {
  const sanitized = { ...input } as T & Record<string, unknown>;
  if (req.actor.type !== "agent") return sanitized;

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:591 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/804aa8eb6584c52b. Report an issue: GitHub.