# rpc错误：代码=权限被拒绝 描述=用户无权访问此资源

- **ID:** `go/grpc-permission-denied-role`
- **领域:** go
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

经过身份验证的用户缺少请求RPC所需的角色或权限，由服务器端授权逻辑强制执行。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 1.22 | active | — | — |
| 1.23 | active | — | — |

## 解决方案

1. **Request elevated permissions from the admin and use a new token.** (90% 成功率)
   ```
   token := getAdminToken() // obtain token with required role
md := metadata.Pairs("authorization", "Bearer "+token)
ctx := metadata.NewOutgoingContext(context.Background(), md)
   ```
2. **Use a service account with necessary roles if available.** (85% 成功率)
   ```
   // Configure gRPC with service account credentials
conn, _ := grpc.Dial(target, grpc.WithPerRPCCredentials(oauth.NewServiceAccountTokenSource("path/to/key.json", "scope")))
   ```

## 无效尝试

- **Re-authenticating with the same credentials.** — Same user, same permissions; still denied. (100% 失败率)
- **Using a different RPC with the same user.** — Permission issue is user-specific, not method-specific. (80% 失败率)