paperclipai/paperclip · error

Project is outside this actor's authorization boundary

Error message

Project is outside this actor's authorization boundary

What it means

Error "Project is outside this actor's authorization boundary" thrown in paperclipai/paperclip.

Source

Thrown at server/src/routes/projects.ts:115

  function readProjectPolicyEnvironmentId(policy: unknown): string | null | undefined {
    if (!policy || typeof policy !== "object" || !("environmentId" in policy)) {
      return undefined;
    }
    const environmentId = (policy as { environmentId?: unknown }).environmentId;
    return typeof environmentId === "string" || environmentId === null ? environmentId : undefined;
  }

  async function resolveCompanyIdForProjectReference(req: Request) {
    const companyIdQuery = req.query.companyId;
    const requestedCompanyId =
      typeof companyIdQuery === "string" && companyIdQuery.trim().length > 0
        ? companyIdQuery.trim()
        : null;
    if (requestedCompanyId) {
      assertCompanyAccess(req, requestedCompanyId);
      return requestedCompanyId;
    }
    if (req.actor.type === "agent" && req.actor.companyId) {
      return req.actor.companyId;
    }
    return null;
  }

  async function normalizeProjectReference(req: Request, rawId: string) {
    if (isUuidLike(rawId)) return rawId;
    const companyId = await resolveCompanyIdForProjectReference(req);
    if (!companyId) return rawId;
    const resolved = await svc.resolveByReference(companyId, rawId);
    if (resolved.ambiguous) {
      throw conflict("Project shortname is ambiguous in this company. Use the project ID.");
    }
    return resolved.project?.id ?? rawId;
  }

  async function assertProjectReadAllowed(req: Request, res: Response, project: { id: string; companyId: string }) {

View on GitHub (pinned to 01ad858492)

Solutions

1. Use an actor/API key that belongs to the company that owns the project.
2. Verify the project id in the request belongs to the caller's company; agent keys cannot cross company boundaries.

When it happens

Trigger: Thrown at server/src/routes/projects.ts:105 when the library encounters an invalid state.

Common situations: Returned when a request attempts to access a project outside the actor's company authorization boundary, e.g. an agent API key from another company.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/c7e650e98c0476eb. Report an issue: GitHub.