paperclipai/paperclip · error

Only board users can vote on AI feedback

Error message

Only board users can vote on AI feedback

What it means

403 guard on POST /issues/:id/feedback-votes. Fires when the actor is not a board user; voting on AI feedback (up/down votes) is a board-user-only action, agent keys are rejected.

Source

Thrown at server/src/routes/issues.ts:13540

        agentId: actor.agentId,
        userId: actor.actorType === "user" ? actor.actorId : null,
        runId: actor.runId,
      },
      {
        afterTombstone: async (deletedComment, tx) => {
          await issueReferencesSvc.syncComment(deletedComment.id, tx);
          await externalObjectsSvc.syncCommentSafely(deletedComment.id, tx);
          annotationCleanup = await documentAnnotationsSvc.cleanupForIssueCommentDeletion(issue.id, deletedComment.id, {
            actorType: actor.actorType,
            actorId: actor.actorId,
            agentId: actor.agentId,
            userId: actor.actorType === "user" ? actor.actorId : null,
            runId: actor.runId,
          }, tx);
          await Promise.all(
            annotationCleanup.deletedCommentIds.map((annotationCommentId) =>
              Promise.all([
                issueReferencesSvc.deleteCommentSource(annotationCommentId, tx),
                externalObjectsSvc.syncCommentSafely(annotationCommentId, tx),
              ])
            ),
          );
          await decisionTrainingSvc.scrubDeletedComments({
            companyId: issue.companyId,
            issueId: issue.id,
            commentIds: [deletedComment.id, ...annotationCleanup.deletedCommentIds],
            deletedAt: deletedComment.deletedAt ?? new Date(),
          }, tx);
        },
      },
    );
    if (!deleted) {
      res.status(404).json({ error: "Comment not found" });
      return;
    }

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:12521 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/af61523bcd0a7611. Report an issue: GitHub.