{
  "id": "go/grpc-permission-denied",
  "signature": "rpc error: code = PermissionDenied desc = caller does not have permission to access resource",
  "signature_zh": "rpc 错误：code = PermissionDenied desc = 调用方无权访问该资源",
  "regex": "rpc\\ error:\\ code\\ =\\ PermissionDenied\\ desc\\ =\\ caller\\ does\\ not\\ have\\ permission\\ to\\ access\\ resource",
  "domain": "go",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "The authenticated caller passed authentication but failed authorization — the principal lacks the required role/scope for the method or resource. Often the token is valid but issued for a different audience or scope.",
  "root_cause_type": "generic",
  "root_cause_zh": "已认证的调用方通过了身份验证，但未通过授权——该主体缺少访问该方法或资源所需的角色/作用域。通常令牌有效，但签发给了不同的受众或作用域。",
  "versions": [
    {
      "version": "1.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Refreshing a valid token yields another valid token with the same scopes; authorization still fails.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Authorization decisions are deterministic per principal; retrying never grants a missing permission.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "",
      "success_rate": 0.85,
      "how": "Log the principal and required scope to confirm the mismatch, and verify the token audience:\n\np, _ := peer.FromContext(ctx)\nlog.Printf(\"denied for peer=%v method=%s\", p.Addr, method)\n// decode JWT claims: check aud and scope",
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "success_rate": 0.82,
      "how": "Request the correct OAuth scope when minting the token and propagate it through the interceptor:\n\n// ensure scope includes the API's required scope, e.g. \"orders.write\"\nts := config.TokenSource(ctx, &oauth2.Token{AccessToken: tok})\nctx = metadata.AppendToOutgoingContext(ctx, \"authorization\", \"Bearer \"+tok)",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": null,
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.84,
  "fix_success_rate": 0.8,
  "resolvable": "partial",
  "first_seen": "2024-11-19",
  "last_confirmed": "2025-01-01",
  "last_updated": "2025-01-01",
  "evidence_count": 0,
  "tags": [],
  "locale": "en",
  "aliases": []
}