Inlorus
Troubleshooting

`NOT_PERMITTED: … default_deny_no_matching_rule`

You pressed a button and the action was refused with this code. The line tells you the missing key and the scope the action was requested in.

For: Platform administrator, Builder, Account administrator, Tenant administrator, Operator

Symptom

  • After an action, a line appears in the form NOT_PERMITTED: scope.write at tenant/…: default_deny_no_matching_rule.
  • The first part of the line is the key (scope.write), the second part is the scope and its identifier (tenant/…), and the end is the reason for the refusal.

Cause

  • inlorus evaluates permission again on every action; if your permission changed after the screen opened, the button may have stayed visible.
  • default_deny_no_matching_rule: no rule matched that gives you that key in that scope. No explicit “deny” rule has ever been written on the platform so far; every refusal comes this way.
  • A key ending in purge does not flow down from above: someone with delete permission in the account cannot delete in a tenant. Delete is granted only by an assignment in the scope that owns the data.

Fix

  1. Refresh the page. If the permission was just granted, the action now goes through.
  2. Make sure the scope is right; the scope switcher shows where you are.
  3. If it is still refused, pass the line on as is to the scope's administrator and ask for a role that carries that key.