# rpc error: code = PermissionDenied desc = user does not have permission to access this resource

- **ID:** `go/grpc-permission-denied-role`
- **Domain:** go
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The authenticated user lacks the required role or permissions for the requested RPC, as enforced by server-side authorization logic.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 1.22 | active | — | — |
| 1.23 | active | — | — |

## Workarounds

1. **Request elevated permissions from the admin and use a new token.** (90% success)
   ```
   token := getAdminToken() // obtain token with required role
md := metadata.Pairs("authorization", "Bearer "+token)
ctx := metadata.NewOutgoingContext(context.Background(), md)
   ```
2. **Use a service account with necessary roles if available.** (85% success)
   ```
   // Configure gRPC with service account credentials
conn, _ := grpc.Dial(target, grpc.WithPerRPCCredentials(oauth.NewServiceAccountTokenSource("path/to/key.json", "scope")))
   ```

## Dead Ends

- **Re-authenticating with the same credentials.** — Same user, same permissions; still denied. (100% fail)
- **Using a different RPC with the same user.** — Permission issue is user-specific, not method-specific. (80% fail)