# X_PERMISSION_UNGRANTED

## Means

an action, query or route requires a permission no role grants

## Typical cause

The policy step: a single-permission rule no role in the app role map holds, so no actor can ever pass it

## Fix

add '<permission>' to the grants of a role in apps/web/shared/roles.ts, then x verify --only policy

[CLI and verify](/error-codes#cli-and-verify)