paperclipai/paperclip · error

Issue activity is outside this actor's authorization boundar

Error message

Issue activity is outside this actor's authorization boundary

What it means

Per-issue authorization gate in the activity routes: the 'issue:read' access decision for the referenced issue was denied (the actor cannot see this issue given its project/parent/assignee context), so its activity entries are withheld with a 403.

Source

Thrown at server/src/routes/activity.ts:210

    assigneeUserId: string | null;
    status: string;
  }) {
    const decision = await access.decide({
      actor: req.actor,
      action: "issue:read",
      resource: {
        type: "issue",
        companyId: issue.companyId,
        issueId: issue.id,
        projectId: issue.projectId,
        parentIssueId: issue.parentId,
        assigneeAgentId: issue.assigneeAgentId,
        assigneeUserId: issue.assigneeUserId,
        status: issue.status,
      },
    });
    if (decision.allowed) return true;
    res.status(403).json({ error: "Issue activity is outside this actor's authorization boundary" });
    return false;
  }

  async function resolveIssueByRef(rawId: string) {
    const identifier = normalizeIssueIdentifier(rawId);
    if (identifier) {
      return issueSvc.getByIdentifier(identifier);
    }
    return issueSvc.getById(rawId);
  }

  router.get("/companies/:companyId/activity", async (req, res) => {
    const companyId = req.params.companyId as string;
    assertCompanyAccess(req, companyId);
    if (!(await assertCompanyScopeReadAllowed(req, res, companyId))) return;

    const filters = {
      companyId,

View on GitHub (pinned to a7e689b3c3)

Solutions

1. Request issue activity only for issues within the actor's authorized company scope.

When it happens

Trigger: Thrown at server/src/routes/activity.ts:210 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-18). Data as JSON: /api/errors/3001e4352afcc657. Report an issue: GitHub.