ruvnet/ruflo · error

Inbound authorization denied for ${sourceNodeId} (addr=${add

Error message

Inbound authorization denied for ${sourceNodeId} (addr=${address})

What it means

The inbound authorization evaluator ran successfully and explicitly returned allowed:false for a peer message while in enforce mode. The denial (with policyReason from the decision) is audited as AUTHORIZATION_DENIED and the envelope is refused with accepted:false.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:443

      sourceNodeId,
      metadata: { address, reason: 'AUTHORIZATION_ERROR', messageType: message.type },
    });
    deps.logger.warn('Inbound rejected: enforce mode has no authorization evaluator');
    return { accepted: false, reason: 'AUTHORIZATION_ERROR' };
  }

  if (authorizationDecision && !authorizationDecision.allowed) {
    if (authorizationMode === 'enforce') {
      await deps.audit.log('message_rejected', {
        sourceNodeId,
        metadata: {
          address,
          reason: 'AUTHORIZATION_DENIED',
          messageType: message.type,
          policyReason: authorizationDecision.reason,
        },
      });
      deps.logger.warn(`Inbound authorization denied for ${sourceNodeId} (addr=${address})`);
      return { accepted: false, reason: 'AUTHORIZATION_DENIED' };
    }
    deps.logger.warn(
      `Inbound authorization would deny ${message.type} from ${sourceNodeId} ` +
        `(mode=${authorizationMode})`,
    );
  }

  // Touch lastSeen on every successful inbound — drives the
  // discovery service's stale-peer detection.
  peer.markSeen();

  // Audit accepted delivery
  await deps.audit.log('message_received', {
    sourceNodeId,
    metadata: {
      address,
      messageType: message.type,

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Review the authorization policy for the denied node; grant the required capability or expect continued denials.

When it happens

Trigger: Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:443 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/43756135043f0884. Report an issue: GitHub.