paperclipai/paperclip · error

Issue is outside this actor's authorization boundary

Error message

Issue is outside this actor's authorization boundary

What it means

The issue read-access check (decideIssueAccess on issue:read) denied the actor, meaning the issue is outside the actor's authorization boundary and denial copy is generated via issueWriteDenialResponse.

Source

Thrown at server/src/routes/issues.ts:4072

  function isSkillTestScopedActor(req: Request) {
    return req.actor.type === "agent" && req.actor.keyScope?.kind === "skill_test";
  }

  function taskBridgeOriginForActor(req: Request) {
    return isTaskBridgeKeyActor(req) && req.actor.keyId
      ? { originKind: "task_bridge", originId: req.actor.keyId }
      : null;
  }

  async function assertTaskBridgeCreateAllowed(
    req: Request,
    companyId: string,
    assignmentScope: TaskAssignmentAuthorizationScope,
  ) {
    if (!isTaskBridgeKeyActor(req)) return;
    await assertCanAssignTasks(req, companyId, assignmentScope);
  }

  async function decideIssueAccess(
    req: Request,
    issue: {
      id: string;
      companyId: string;
      projectId: string | null;
      parentId: string | null;
      assigneeAgentId: string | null;
      assigneeUserId: string | null;
      status: string;
    },
    action: "issue:comment" | "issue:read" | "issue:mutate",
  ) {
    return access.decide({
      actor: req.actor,
      action,
      resource: {
        type: "issue",

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:3908 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/ad9db9271d3227ed. Report an issue: GitHub.