plandex-ai/plandex · warning

User does not have permission to create a plan

Error message

User does not have permission to create a plan

What it means

CreatePlanHandler returns this 403 Forbidden when the authenticated user's auth context lacks the shared.PermissionCreatePlan permission. This is an authorization check, not a runtime failure: the server deliberately rejects the request because the org/user's role or plan restrictions do not grant plan creation.

Source

Thrown at app/server/handlers/plans_crud.go:32

	"strings"
	"time"

	shared "plandex-shared"

	"github.com/gorilla/mux"
)

func CreatePlanHandler(w http.ResponseWriter, r *http.Request) {
	log.Println("Received request for CreatePlanHandler")

	auth := Authenticate(w, r, true)
	if auth == nil {
		return
	}

	if !auth.HasPermission(shared.PermissionCreatePlan) {
		log.Println("User does not have permission to create a plan")
		http.Error(w, "User does not have permission to create a plan", http.StatusForbidden)
		return
	}

	vars := mux.Vars(r)
	projectId := vars["projectId"]

	log.Println("projectId: ", projectId)

	if !authorizeProject(w, projectId, auth) {
		return
	}

	_, apiErr := hooks.ExecHook(hooks.WillCreatePlan, hooks.HookParams{Auth: auth})
	if apiErr != nil {
		writeApiError(w, *apiErr)
		return
	}

View on GitHub (pinned to e2d772072e)

Solutions

1. Have an org admin grant the user's role/group the create-plan permission
2. Check the org's subscription/settings to confirm plan creation is enabled
3. Verify you are authenticated as the intended user (token for the right account/org)
4. If self-hosting, inspect the permission model for shared.PermissionCreatePlan and the user's assigned permissions

const perms = await getMyPermissions(orgId);
if (!perms.includes('create_plan')) {
  throw new Error('Your role cannot create plans — request permission from an org admin');
}

function canCreatePlan(auth) {
  return typeof auth === 'object' && auth !== null
    && Array.isArray(auth.permissions)
    && auth.permissions.includes('create_plan');
}

try {
  await createPlan(projectId, name);
} catch (e) {
  if (/permission to create a plan/i.test(e.message)) {
    notifyUser('You need the create-plan permission; contact your org admin.');
    return;
  }
  throw e;
}

When it happens

Trigger: POST to create a plan by a user whose org role (e.g. read-only or restricted member) does not include PermissionCreatePlan, or whose org plan tier disables plan creation; also occurs when an admin removed the permission from the user's group.

Common situations: New org member with default restricted role tries to create plans; org downgraded their subscription so create-plan permission was revoked; permission misconfigured in the org's group settings.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• User does not have permission to rename project
• User does not have permission to delete project
• User does not have permission to update plan
• User does not have permission to delete plan
• User does not have permission to rename plan

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/7bce863e49bbec46. Report an issue: GitHub.