No roles for the user (no_user_roles)
A denied decision with the code no_user_roles means the user exists in Permit but has no role assignment in any tenant. This page is for developers who find this code in a decision log and need to assign a role to the user.
What the no_user_roles reason means
The policy decision point (PDP) writes this code in the role-based access control (RBAC) part of the decision log's debug details (debug.rbac). The debug details appear when Debug Mode is on.
| Field | Value |
|---|---|
code | no_user_roles |
reason | no roles assigned to user '<user-key>' |
support_link | A link to /errors/no_user_roles on docs.permit.io |
The PDP runs its RBAC checks in a fixed order and reports the first one that fails. When you see no_user_roles, the resource type, the action, and the tenant exist, and the user is synced. The user has no roles in any tenant.
If the user has roles in other tenants but not in the tenant of the check, the code is no_role_in_tenant instead.
Causes of no_user_roles
| Cause | How to confirm | Fix |
|---|---|---|
| Your app synced the user without role assignments. | The user has no roles in the Directory screen. | Assign a role to the user. |
| Someone removed the user's last role assignment. | The user has no roles in the Directory screen, and had roles before. | Assign a role to the user. |
| The check uses a different user key than the user that has roles, and both users exist. | The user key in the reason differs from the key of the user with roles. | Send the user key of the user with roles in permit.check(). |
Fix no_user_roles
Assign a role in the Permit dashboard
- Open the Directory screen in the Permit dashboard.
- Select the user and add a role assignment.
- Choose the tenant that the check names and the role that grants the action, then save.
For a walkthrough with screenshots, see Assign a role to the user.
Assign a role with the API
Call the Assign role endpoint with the user, role, and tenant keys.
Assign a role with an SDK
To assign roles when you sync the user, pass role assignments in the sync call. See Sync users.
Confirm the fix
- Run the same
permit.check()call again with the same user, action, resource, and tenant. To run the check from a terminal, usepermit pdp check. - Open the Audit Log and select the new decision.
The debug.rbac.code is no longer no_user_roles. If the code is no_role_in_tenant or no_permission, the role assignment exists, and the next check failed.