# rpc 错误：code = PermissionDenied desc = 调用方无权访问该资源

- **ID:** `go/grpc-permission-denied`
- **领域:** go
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

已认证的调用方通过了身份验证，但未通过授权——该主体缺少访问该方法或资源所需的角色/作用域。通常令牌有效，但签发给了不同的受众或作用域。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 1.x | active | — | — |

## 解决方案

1. **** (85% 成功率)
   ```
   Log the principal and required scope to confirm the mismatch, and verify the token audience:

p, _ := peer.FromContext(ctx)
log.Printf("denied for peer=%v method=%s", p.Addr, method)
// decode JWT claims: check aud and scope
   ```
2. **** (82% 成功率)
   ```
   Request the correct OAuth scope when minting the token and propagate it through the interceptor:

// ensure scope includes the API's required scope, e.g. "orders.write"
ts := config.TokenSource(ctx, &oauth2.Token{AccessToken: tok})
ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)
   ```

## 无效尝试

- **** — Refreshing a valid token yields another valid token with the same scopes; authorization still fails. (85% 失败率)
- **** — Authorization decisions are deterministic per principal; retrying never grants a missing permission. (95% 失败率)