paperclipai/paperclip · error

Low-trust actors cannot use this control-plane surface

Error message

Low-trust actors cannot use this control-plane surface

What it means

403 guard from assertLowTrustControlPlaneDenied: the issue's effective trust preset is not 'standard' (low-trust company/project/issue), and low-trust actors are denied this control-plane surface.

Source

Thrown at server/src/routes/issues.ts:3234

      input.executionWorkspaceSettings !== undefined;
  }

  async function resolveRunIssueWorkspaceInheritanceSource(
    companyId: string,
    actor: ReturnType<typeof getActorInfo>,
  ): Promise<string | null> {
    if (actor.actorType !== "agent" || !actor.agentId || !actor.runId) return null;
    const run = await db
      .select({
        agentId: heartbeatRuns.agentId,
        contextSnapshot: heartbeatRuns.contextSnapshot,
      })
      .from(heartbeatRuns)
      .where(and(
        eq(heartbeatRuns.id, actor.runId),
        eq(heartbeatRuns.companyId, companyId),
      ))
      .then((rows) => rows[0] ?? null);
    if (!run || run.agentId !== actor.agentId) return null;
    const context = run.contextSnapshot && typeof run.contextSnapshot === "object"
      ? run.contextSnapshot as Record<string, unknown>
      : null;
    if (!context || !readNonEmptyString(context.executionWorkspaceId)) return null;
    const paperclipIssue = context.paperclipIssue && typeof context.paperclipIssue === "object"
      ? context.paperclipIssue as Record<string, unknown>
      : null;
    return readNonEmptyString(context.issueId) ?? readNonEmptyString(paperclipIssue?.id);
  }

  async function resolveAgentTrustForIssue(
    input: {
      agentId: string | null | undefined;
      runId?: string | null;
    },
    companyId: string,
    issue?: { companyId: string; projectId?: string | null; executionPolicy?: unknown } | null,

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:3070 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/e905a0cbf2f0babf. Report an issue: GitHub.