phacility/phabricator · error · PhabricatorMetaMTAReceivedMailProcessingException

err:policy

err:policy

Error message

This mail is addressed to an object ("%s") you do not have permission to see: %s

What it means

loadObject() for the object named in the mail address (e.g. the T123 in T123+hash@...) threw PhabricatorPolicyException: the sender, as a PhabricatorUser, is not allowed to see that object. The mail is rejected with STATUS_POLICY_PROBLEM ('err:policy') and the policy exception's own message is embedded, so the received-mail record explains exactly which policy blocked access.

Source

Thrown at src/applications/metamta/receiver/PhabricatorObjectMailReceiver.php:50

    PhutilEmailAddress $target) {

    $parts = $this->matchObjectAddress($target);
    if (!$parts) {
      // We should only make it here if we matched already in "canAcceptMail()",
      // so this is a surprise.
      throw new Exception(
        pht(
          'Failed to parse object address ("%s") during processing.',
          (string)$target));
    }

    $pattern = $parts['pattern'];
    $sender = $this->getSender();

    try {
      $object = $this->loadObject($pattern, $sender);
    } catch (PhabricatorPolicyException $policy_exception) {
      throw new PhabricatorMetaMTAReceivedMailProcessingException(
        MetaMTAReceivedMailStatus::STATUS_POLICY_PROBLEM,
        pht(
          'This mail is addressed to an object ("%s") you do not have '.
          'permission to see: %s',
          $pattern,
          $policy_exception->getMessage()));
    }

    if (!$object) {
      throw new PhabricatorMetaMTAReceivedMailProcessingException(
        MetaMTAReceivedMailStatus::STATUS_NO_SUCH_OBJECT,
        pht(
          'This mail is addressed to an object ("%s"), but that object '.
          'does not exist.',
          $pattern));
    }

    $sender_identifier = $parts['sender'];

View on GitHub (pinned to 5720a38cfe)

Solutions

Grant the sender view access to the object (edit its policy, add the user to the project, or adjust Space membership).
If the restriction is intentional, tell the sender to stop replying by mail and request access through the web UI.
Read the embedded policy message in the received-mail record — it names the blocking policy.

Defensive patterns

Strategy: validation

Validate before calling

// Before notifying a user by mail, confirm they can see the object:
$visible = id(new PhabricatorObjectQuery())
  ->setViewer($user)
  ->withPHIDs(array($object->getPHID()))
  ->execute();
if (!$visible) {
  // skip or adjust the mail: recipient cannot see this object
}

Try / catch

try {
  $receiver->processReceivedMail($mail, $target);
} catch (PhabricatorMetaMTAReceivedMailProcessingException $ex) {
  if ($ex->getStatusCode() === MetaMTAReceivedMailStatus::STATUS_POLICY_PROBLEM) {
    // reply explaining the sender lacks access to the target object
  }
}

Prevention

When tightening object policies or moving objects between Spaces, expect mail replies from users who lost access to fail with err:policy.
Audit subscriber lists after policy changes and remove users who can no longer see the object.
Educate users that replying by mail requires the same view permission as the web UI.

When it happens

Trigger: Replying by mail to a task/project whose policy was tightened after the notification was sent (restricted project, moved into a Space); a user mailing an object address directly for an object they have never had access to; newly created or external-collaborator accounts without membership in the required project.

Common situations: Policy or Space changes after notifications went out; users replying to very old threads for now-restricted objects; partner accounts collaborating on only part of an install.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/0e602f2856f40200. Report an issue: GitHub.