paperclipai/paperclip · error · HttpError

subject_not_permitted

subject_not_permitted

Error message

The agent run cannot start authorization for the requested user

What it means

Authorization-scope guard in startAuthorizationForAgent: the agent run's responsible user does not match the subjectUserId on whose behalf OAuth consent was requested. Prevents an agent run from initiating consent for a different user's identity; the mismatched subject user is at fault.

Solutions

1. The run's context cannot initiate authorization for that user. Ensure the run is associated with the requesting user or start authorization from an interactive session.

When it happens

Trigger: Thrown at server/src/services/tool-access.ts:6021 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@3f1d897a7c (2026-08-18). Data as JSON: /api/errors/6f3592bb10d81368. Report an issue: GitHub.

Appendix: source

Thrown at server/src/services/tool-access.ts:8653

      actor: input.actor,
      request: {
        applicationId: input.connection.applicationId,
        connectionId: input.connection.id,
        catalogEntryId: input.catalogEntry.id,
        toolName: input.catalogEntry.toolName,
        arguments: sampleArguments(input.catalogEntry.toolName),
      },
    };
    const decision = await policySvc.decide(decisionInput);
    const auditResult = await policySvc.writeAudit(
      decisionInput,
      decision,
      "policy_decision",
    );
    return {
      name: input.name,
      ok: decision.decision === input.expectedDecision,
      toolName: input.catalogEntry.toolName,
      expectedDecision: input.expectedDecision,
      decision: decision.decision,
      reasonCode: decision.reasonCode,
      explanation: decision.explanation,
      auditEventId: auditResult.legacyAuditEvent.id,
      toolCallEventId: auditResult.toolCallEvent.id,
    };
  }

  function actionSummary(
    entry: ToolCatalogEntry,
  ): ToolAppConnectionActionSummary {
    return {
      catalogEntryId: entry.id,
      toolName: entry.toolName,
      title: entry.title,
      description: entry.description,
      riskLevel: entry.riskLevel,

View on GitHub (pinned to 3f1d897a7c)