Automation fails with strange error (Actor does not have permission...)

[Koloman Pfeffer]

Hello everyone, 

I encountered a strange error in one of our Confluence automation rules - this one particular rule fails from time to time without having been triggered and I can't even decipher the error message ("The rule actor doesn't have permission to view the event that triggered this rule").

Here's the rule in question: 

Here's the audit log: 

But if I look at the page history, there has been no edit or anything that should trigger the rule. It's also being triggered correctly, when I edit the page, so I can't figure out, why this error is coming up repeatedly.

Also I am our Confluence Admin and I have full permissions in this space and for this page, so there is definitely no permissions problem here, so this support document didn't help https://confluence.atlassian.com/automationkb/automation-rule-is-failing-with-actor-does-not-have-permission-to-view-one-or-more-issues-or-the-issue-was-deleted-1442907303.html 

Did any of you encounter this problem before and knows how to fix it?

Thanks,
Koloman

[Marc - Devoteam]

Hi @Koloman Pfeffer 

Check this support article for possible solutions, automation-error-actor-does-not-have-permission-to-view 

[Koloman Pfeffer]

Hi @Marc - Devoteam

Thanks, I forgot to mention this article in my post. I already read it but I feel like it's not applicable to my problem, because there are no missing permissions as I am our main admin and I'm also the rule actor. The issue security scheme also can't be the problem, as this is Confluence Automation and there are no security schemes as in JSM.

[Marc - Devoteam]

Hi @Koloman Pfeffer 

Question, what if you use a normal condition and not the condition in the trigger?

Second question, what is the ID, is this a page ID, this won't work.

ID in CQL relates to to a piece of content that is on the page that has been set with a content ID

If I'm wrong here and you do have content with an id, then the CQL is wrong as it needs to be ID not id

[Koloman Pfeffer]

I used a normal condition before, but the behaviour was the same. Switching to the trigger condition was a try to limit, when the rule would be triggered.

And yes, I tried to limit it to the page ID. The CQL documentation suggested that this would be what it would refer to, syntax with id instead of ID should be correct according to https://developer.atlassian.com/cloud/confluence/cql-fields/#id

But I'll change it back to a normal condition that works on a label or the pages name, but I would still suspect, that this is not the reason for this issue.

[Bill Sheboy]

Hi @Koloman Pfeffer 

Short answer: I recommend removing the condition from the trigger and adding a separate condition after it, setting the actor back to Automation for Jira, and then monitoring your rule.

Rule triggers can have racetrack timing problems, where all of the data may not be present at the time the event happens and the rule starts.  And, using a specific user, rather than the default Automation for Jira user, means any attempts to perform that condition test on a page for which you do not have permissions might unpredictably lead to an error due to missing access or data.

I recommend not using the new feature with conditions in triggers until Atlassian solves the architectural challenges causing the racetrack timing problems and public announces they have done so.  This defect pre-dates that new feature, although it seems to appear much more frequently now...based upon community posts / questions.  Atlassian knows about this defect, although there is no timeframe described for a solution in their acknowledgment posts.

Kind regards,
Bill

[Koloman Pfeffer]

Hi @Bill Sheboy 

Thanks for your answer. As this is Confluence Automation, there is no default automation user. The rule actor is always set to the rule owner and you can't even change it to another account than your own.

Nevertheless, the timing problems could still be the cause of this issue, so hopefully this gets fixed soon, as I don't want to disable notifications when the rule fails, because I should still be the one maintaining it and ensure it works.

Do you know is there any support ticket or request about this issue one could vote for?

Kind regards
Koloman

[Bill Sheboy]

Oops; thanks for the reminder this was for Confluence rules, @Koloman Pfeffer !

There are many related, open defects for timing-related symptoms, and here is the most recent one I found:

https://jira.atlassian.com/browse/AUTO-2061

And, here is the post from an Atlassian team member regarding the in-progress architectural changes to address the racetrack timing and triggers:

https://community.atlassian.com/forums/Automation-articles/Unlock-Advanced-Workflow-Orchestration-With-These-New/bc-p/3064530#M1996

If that symptom is still happening with the Confluence rule, I recommend working with your Site / Product Admin to submit a ticket to Atlassian Support to take a look.  You are on a paid license and so the admin can do that at the link below.  When you hear back from them, please post what you learn to benefit the community.

https://support.atlassian.com/contact/#/

[Valerie Knapp]

Hi @Koloman Pfeffer , thanks for your post.

Please can you also share this screen?

The Rule Details section is where the Actor is stored but reading this - https://support.atlassian.com/cloud-automation/docs/what-is-a-rule-actor/ for Confluence automations, it sounds like you can't change the author to be someone other than yourself anyway.

The message in the audit log makes it sound like a page was edited by that user, but in a space that your user (or whoever the rule actor is) does not have access to. Is that something that could be happening?

[Koloman Pfeffer]

Hi @Valerie Knapp

Oh I forgot to mention that I am the rule actor in this case with full permissions for this space and the page edited. 

And also I think the problem lies somewhere else, as the page history doesn't show any edits on the page for the times where the rule failed.