No role grants the permission (no_permission)

A denied decision with the code no_permission means the user has at least one role in the tenant, but none of those roles grants the checked action on the resource type. This page is for developers who find this code in a decision log and need to fix the policy or the check.

What the no_permission reason means

The policy decision point (PDP) writes this code in the role-based access control (RBAC) part of the decision log's debug details (debug.rbac). The debug details appear when Debug Mode is on.

Field	Value
code	no_permission
reason	user '<user-key>' does not have any role that grants him the '<action>' permission on resources of type '<resource-type>'
support_link	A link to /errors/no_permission on docs.permit.io

The PDP runs its RBAC checks in a fixed order and reports the first one that fails. When you see no_permission, the earlier checks passed:

1. The resource type exists.
2. The action is defined on the resource type.
3. The tenant exists.
4. The user is synced to Permit.
5. The user has at least one role in the tenant.

Only the last step failed: no role that the user holds in this tenant has the action checked in the policy.

Causes of no_permission

Cause	How to confirm	Fix
The role exists, but the policy doesn't grant it the action on this resource type.	In the Policy Editor, the checkbox for this role, resource, and action is clear.	Grant the action to the role.
The user holds the right role in a different tenant, not the tenant in the check.	In the Directory screen, the user's role assignment lists another tenant.	Assign the role in the checked tenant.
The check uses a different action key than the one the policy grants, for example edit instead of update.	The action in the reason differs from the action you granted in the Policy Editor.	Send the action key the policy grants in permit.check().
You expected an attribute-based access control (ABAC) rule to grant the action, and that rule also denied the request.	The decision log also has debug.abac details.	Read the ABAC code, for example no_matching_rules.

Fix no_permission

Grant the action to the role in the Policy Editor

1. Open the Policy Editor in the Permit dashboard.
2. Find the column for the role and the row for the resource type and action from the reason.
3. Select the checkbox, then click Save.

For a full walkthrough of granting permissions to roles, see Building an RBAC policy.

Grant the action to the role with the API

Call the Assign permissions to role endpoint with the permission in the <resource-type>:<action> form. For a resource role, use Assign permissions to resource role.

Grant the action to the role with an SDK

Update the role's permissions with an SDK:

• Update a role with the Node.js SDK
• Create a role with permissions in the Python SDK
• All SDKs

Confirm the fix

1. Run the same permit.check() call again with the same user, action, resource, and tenant. To run the check from a terminal, use permit pdp check.
2. Open the Audit Log and select the new decision.

The decision is Allow, and debug.rbac.reason names the role that grants the permission.

Related pages

• Audit log types and decision logs
• Check permissions with permit.check()
• No roles for the user in this tenant (no_role_in_tenant)