No roles for the user in this tenant (no_role_in_tenant)
A denied decision with the code no_role_in_tenant means the user has role assignments in other tenants, but no role in the tenant that the permission check names. This page is for developers who find this code in a decision log and need to fix the role assignment or the tenant in the check.
What the no_role_in_tenant reason means
The policy decision point (PDP) writes this code in the role-based access control (RBAC) part of the decision log's debug details (debug.rbac). The debug details appear when Debug Mode is on.
| Field | Value |
|---|---|
code | no_role_in_tenant |
reason | user '<user-key>' has no assigned roles in tenant '<tenant-key>'. user has roles in these tenants: <tenant-keys> |
support_link | A link to /errors/no_role_in_tenant on docs.permit.io |
In Permit, a role assignment belongs to one tenant. A role in tenant a grants nothing on resources in tenant b. When you see no_role_in_tenant, the resource type, action, tenant, and user all exist, and the user has roles in the tenants listed at the end of the reason.
If the user has no role in any tenant, the code is no_user_roles instead.
Causes of no_role_in_tenant
| Cause | How to confirm | Fix |
|---|---|---|
| The user needs a role in this tenant, and nobody assigned one. | The tenant from the reason is missing from the user's role assignments in the Directory screen. | Assign a role in the tenant. |
| The check sends a different tenant key than the tenant the user belongs to. | The tenant in the reason differs from the tenant the user belongs to. | Pass the tenant key in the resource of permit.check(). See Check a permission in a tenant. |
| The tenant key has a different case than the tenant the role belongs to. | The tenant keys in the reason differ only in case. | Send the tenant key with the exact case. |
Fix no_role_in_tenant
Assign a role in the tenant in the Permit dashboard
- Open the Directory screen in the Permit dashboard.
- Select the user and add a role assignment.
- Choose the tenant from the
reasonand the role that grants the action, then save.
For a walkthrough with screenshots, see Assign a role to the user.
Assign a role in the tenant with the API
Call the Assign role endpoint with the user, role, and tenant keys.
Assign a role in the tenant with an SDK
Confirm the fix
- Run the same
permit.check()call again with the same user, action, resource, and tenant. To run the check from a terminal, usepermit pdp checkwith--tenant. - Open the Audit Log and select the new decision.
The debug.rbac.code is no longer no_role_in_tenant. If the code is no_permission, the user has a role in the tenant, and that role doesn't grant the action. See No role grants the permission (no_permission).