paperclipai/paperclip · error · HttpError

subject_not_permitted

subject_not_permitted

Error message

The agent run cannot start authorization for the requested user

What it means

Authorization-scope guard in startAuthorizationForAgent: the agent run's responsible user does not match the subjectUserId on whose behalf OAuth consent was requested. Prevents an agent run from initiating consent for a different user's identity; the mismatched subject user is at fault.

Source

Thrown at server/src/services/tool-access.ts:6230

    name: string;
  }): Promise<ToolExampleSmokeCheck> {
    const decisionInput = {
      companyId: input.companyId,
      actor: input.actor,
      request: {
        applicationId: input.connection.applicationId,
        connectionId: input.connection.id,
        catalogEntryId: input.catalogEntry.id,
        toolName: input.catalogEntry.toolName,
        arguments: sampleArguments(input.catalogEntry.toolName),
      },
    };
    const decision = await policySvc.decide(decisionInput);
    const auditResult = await policySvc.writeAudit(decisionInput, decision, "policy_decision");
    return {
      name: input.name,
      ok: decision.decision === input.expectedDecision,
      toolName: input.catalogEntry.toolName,
      expectedDecision: input.expectedDecision,
      decision: decision.decision,
      reasonCode: decision.reasonCode,
      explanation: decision.explanation,
      auditEventId: auditResult.legacyAuditEvent.id,
      toolCallEventId: auditResult.toolCallEvent.id,
    };
  }

  function actionSummary(entry: ToolCatalogEntry): ToolAppConnectionActionSummary {
    return {
      catalogEntryId: entry.id,
      toolName: entry.toolName,
      title: entry.title,
      description: entry.description,
      riskLevel: entry.riskLevel,
      isReadOnly: entry.isReadOnly,
      isWrite: entry.isWrite,

View on GitHub (pinned to 01ad858492)

Solutions

1. The run's context cannot initiate authorization for that user. Ensure the run is associated with the requesting user or start authorization from an interactive session.

When it happens

Trigger: Thrown at server/src/services/tool-access.ts:6021 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/6f3592bb10d81368. Report an issue: GitHub.