ALC-3005: Not allowed for this role

Alcuin refused an action because the permission it needs is missing. This happens in three unrelated places: acting on another session in Activity, the assistant sending to its provider, and a file Alcuin was given that has changed in a way it won’t follow.

If the message comes from Postgres itself, such as permission denied for table orders, it is the server’s error (SQLSTATE 42501), not this one. The Postgres manual on privileges covers it.

Canceling or terminating another session

What you see

In Activity, after Cancel query or Terminate session: This role may not cancel session 4821. or This role may not terminate session 4821.

Why it happens

Postgres lets a role signal its own sessions, and others’ only when it is a member of pg_signal_backend or a superuser. Only a superuser may signal a superuser’s session. Alcuin offers Cancel query and Terminate session only where your role may use them, and checks again when you click. You see this error when that changed in between: your role lost a grant, or the session now belongs to someone else.

What to do

1. Let Activity refresh, and look at the session again.
2. To act on other users’ sessions, ask an administrator to grant the role membership: GRANT pg_signal_backend TO app;. See Predefined roles.

The assistant and its provider

What you see

In the assistant pane, or under Test connection in Settings, under AI Assistant:

• The provider refused the API key, followed by what the provider said.
• Sending to https://api.example.com was not allowed. Alcuin asks again after it restarts, or when you set another address in Settings, under AI Assistant.
• The API key was saved for another address, so it was not sent to https://api.example.com. Enter it again in Settings, under AI Assistant.
• That address is not the one set in Settings. or Alcuin calls only the addresses you set in Settings, and … is not one of them.
• Nothing here can approve an address for the assistant; it needs the Alcuin app.

Why it happens

• The provider rejected the key: it is wrong, expired, revoked, or lacks access to the model.
• The first time the assistant sends to an address, Alcuin asks Let the assistant send to …?. You chose Don’t send, and Alcuin remembers that until it restarts.
• You changed Address after saving the key. Alcuin keeps the key for the address it was saved with and does not send it anywhere else.
• A request named an address other than the one in Settings. Alcuin refuses it before anything leaves the machine.

What to do

1. Open Settings, under AI Assistant, and check Address. Set up a provider explains each field.
2. Enter the API key again if the message says it was refused or saved for another address. Check with the provider that the key is active and may use the Model you set.
3. If you declined the address and want to allow it, restart Alcuin, then choose Allow when it asks.
4. Click Test connection.

A file that changed under Alcuin

What you see

When you open or save a file you chose earlier, such as a .sql file, one of:

• query.sql is a link, and Alcuin doesn't follow links to files. Choose the file it points to.
• query.sql has another name on disk (a hard link), so Alcuin won't use it. Make a copy and choose that.
• query.sql was replaced by a file someone else owns. Choose it again.
• The folder holding query.sql has moved or become a link. Choose the file again.
• query.sql changed while it was being read. Try again.

What to do

Choose the file again with Open file…, or try again for a file that was being written. Alcuin uses a file only as the one you chose, so a link or a swapped file needs you to choose it.

Internal name

The engine reports this as ENGINE_PERMISSION_DENIED. Quote either name in an issue.