Diagnose and grant access¶
Purpose¶
Resolve a missing capability by changing the appropriate membership, role, resource allowance or key policy. First identify which boundary refused the request; a broader role is not a substitute for a missing inference grant.
Prerequisites¶
Have authority to inspect and change the target scope. People administration uses people.manage; Team membership uses team.members.manage; resource allowance uses team.allowance.manage. Key and deployment changes have their own permissions. A grant must stay within your authority; see Roles and permissions.
Ask for the intended Team, operation/resource, time, safe error code and correlation/decision ID. A secret key or private prompt is not needed for an access request.
Procedure¶
- Confirm the person or service account, active membership and selected Team. Rejoining creates a new membership instance; an old key does not revive.
- Identify the missing boundary using the table below. Inspect current state before changing it.
- Apply the narrow change through the linked management page. A grant request cannot supply its own payer, verified person or namespace.
- Ask the requester to retry one permitted operation. Check the resulting Request and confirm a resource outside the intended scope remains denied.
| Symptom | Inspect | Change through |
|---|---|---|
| Cannot open or edit a Console page | Current human permissions at the page's scope | People, Team roles |
| Cannot create a personal key | Active Team membership and keys.user.create |
Team membership |
| Key cannot discover or invoke a resource | Catalog availability, Team allowance, key operation and resource policy | Configuration, Teams, virtual keys |
| Cannot use a published Agent | Chat audience, or API caller plus eligible invoke key | Live access |
| Metadata is visible but content is hidden | Separate content and export permissions; actual capture and retention | Observation access |
| Tool asks for approval | The exact pending administrator decision | Approvals |
| Tool needs an upstream account | Company or personal connection authorization | Connectors, personal accounts |
| Request hits a cap | The applicable funding/rate constraint | Budgets |
Expected result¶
The requester gains the intended capability within the existing catalog and scope. Human roles and virtual-key inference policy remain separate. Current policy edits are checked on the next call without a restart; secret rotation requires clients to reload the replacement credential.
Verification¶
Keep the safe allowed/denied request identifiers and inspect Audit for the management change. Do not ask the requester to repeat a business action whose original outcome is uncertain merely to test access.
Failure recovery¶
For a revision conflict, reload current state before applying another change. If membership was removed or the key revoked, provision a new eligible credential. Missing provider/Connector configuration requires an operator's file change and restart; permission edits alone cannot repair it.
The former Project/Agent binding request queue is retired. Its old pages point to Teams, roles and virtual keys and do not create bindings. Use the current management pages above.