phacility/phabricator · error · PhabricatorWorkerPermanentFailureException

Job actor does not have permission to edit job.

Error message

Job actor does not have permission to edit job.

What it means

Before doing any work, bulk workers verify via PhabricatorPolicyFilter::hasCapability() that the job's author still holds CAN_EDIT on the job; if not, the task permanently fails. The check ensures a queued job cannot keep acting with authority its author no longer legitimately has.

Source

Thrown at src/infrastructure/daemon/workers/bulk/PhabricatorWorkerBulkJobWorker.php:76

  final protected function loadActor(PhabricatorWorkerBulkJob $job) {
    $actor_phid = $job->getAuthorPHID();
    $actor = id(new PhabricatorPeopleQuery())
      ->setViewer(PhabricatorUser::getOmnipotentUser())
      ->withPHIDs(array($actor_phid))
      ->executeOne();
    if (!$actor) {
      throw new PhabricatorWorkerPermanentFailureException(
        pht('Worker has invalid actor PHID ("%s").', $actor_phid));
    }

    $can_edit = PhabricatorPolicyFilter::hasCapability(
      $actor,
      $job,
      PhabricatorPolicyCapability::CAN_EDIT);

    if (!$can_edit) {
      throw new PhabricatorWorkerPermanentFailureException(
        pht('Job actor does not have permission to edit job.'));
    }

    // Allow the worker to fill user caches inline; bulk jobs occasionally
    // need to access user preferences.
    $actor->setAllowInlineCacheGeneration(true);

    return $actor;
  }

  final protected function updateJob(PhabricatorWorkerBulkJob $job) {
    $has_work = $this->hasRemainingWork($job);
    if ($has_work) {
      return;
    }

    $lock = $this->acquireJobLock();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Check the job's edit policy and the author's current access in the UI.
2. Either restore the author's edit capability on the job or cancel the job — it cannot proceed otherwise.
3. For custom job types, keep queued jobs under policies their authors will retain.

$can_edit = PhabricatorPolicyFilter::hasCapability(
  $author,
  $job,
  PhabricatorPolicyCapability::CAN_EDIT);
if (!$can_edit) {
  // do not queue the job: the worker will permanently fail
}

try {
  // run the bulk worker
} catch (PhabricatorWorkerPermanentFailureException $ex) {
  // policy drift: re-grant edit or cancel the job; retrying will not help
}

When it happens

Trigger: The job's edit policy (or that of its container) was tightened after the job was queued so the author lost edit access; the author's roles/approvals changed; the author account was disabled in a way that revokes edit capability.

Common situations: Policy tightening on projects or objects while bulk jobs are pending; compliance-driven permission revocations; policy recomputation after upgrades or migrations.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• err:policy
• This blog is not visible to logged out users, so it can not
• You can not make that edit, because it would remove your abi
• Unable to change ownership of an identity file to daemon use
• Failed to create directory "%s" for specified log file (with

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/f303aeb9376d1626. Report an issue: GitHub.