paperclipai/paperclip · error

Low-trust agents must create child issues inside their assig

Error message

Low-trust agents must create child issues inside their assigned boundary

What it means

403 from issue creation for agents. Fires when a low-trust agent attempts to create a top-level (parentless) issue; low-trust agents may only create child issues nested inside their assigned parent boundary, not root issues.

Source

Thrown at server/src/routes/issues.ts:8813

    if (!(await assertDeliverableMutationAllowedByRunContext(req, res, issue))) return;
    const workProduct = await workProductsSvc.getById(workProductId);
    if (!workProduct || workProduct.issueId !== issue.id || workProduct.companyId !== issue.companyId) {
      res.status(404).json({ error: "Work product not found" });
      return;
    }
    const actor = getActorInfo(req);
    const result = await ensureArtifactReviewDocumentForWorkProduct({ issue, workProduct, actor });
    res.status(result.created ? 201 : 200).json(result.document);
  });

  router.post("/issues/:id/low-trust/promotions", validate(promoteLowTrustOutputSchema), async (req, res) => {
    const id = req.params.id as string;
    const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
    if (!issue) return;
    if (!(await assertIssueReadAllowed(req, res, issue))) return;
    if (!(await assertAgentIssueMutationAllowed(req, res, issue))) return;
    if (!(await assertDeliverableMutationAllowedByRunContext(req, res, issue))) return;
    const actor = getActorInfo(req);
    if (await sourceTrustForActorWrite(issue, actor)) {
      res.status(403).json({ error: "Low-trust actors cannot promote quarantined output" });
      return;
    }
    const sourceTrust = await lookupLowTrustSourceArtifact({
      issueId: issue.id,
      artifactKind: req.body.sourceArtifactKind,
      artifactId: req.body.sourceArtifactId,
    });
    if (!sourceTrust) {
      res.status(404).json({ error: "Low-trust source artifact not found" });
      return;
    }
    if (!isLowTrustQuarantined(sourceTrust)) {
      res.status(422).json({ error: "Source artifact is not quarantined low-trust output" });
      return;
    }

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:8192 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/ad880fd635c5082f. Report an issue: GitHub.