feat: propagate RunAsMe to child process tool jobs#764
Merged
dsuresh-ap merged 1 commit intomainfrom Apr 16, 2026
Merged
Conversation
4 tasks
dsuresh-ap
force-pushed
the
feature/run-as-me-propagation-JAR-9434
branch
from
2ff7cf4 to
6f2b82a
Compare
maxduu
reviewed
Apr 16, 2026
maxduu
reviewed
Apr 16, 2026
|
|
||
| sub_type = get_claim_from_token("sub_type") | ||
| is_conversational = UiPathConfig.is_conversational | ||
| is_user_token = sub_type == "user" |
Contributor
There was a problem hiding this comment.
Were you able to verify that when running with runasme=false, the sub_type isn't "user"?
Member
Author
There was a problem hiding this comment.
With my user auth token:
[2026-04-16 12:05:03,579][INFO] Token sub_type='service.external'
[2026-04-16 12:05:03,579][INFO] RunAsMe decision: is_conversational=True, is_user_token=False, run_as_me=False
With an external app token:
[2026-04-16 12:06:06,944][INFO] Token sub_type='user'
[2026-04-16 12:06:06,944][INFO] RunAsMe decision: is_conversational=True, is_user_token=True, run_as_me=True
maxduu
reviewed
Apr 16, 2026
| _cached_should_run_as_me: dict[str, bool] = {} | ||
|
|
||
|
|
||
| def _should_run_as_me() -> bool: |
Collaborator
There was a problem hiding this comment.
An observation is that this approach makes all conversational agents' (even deployed ones) started processes run under the same identity via run_as_me: True. Is this intended?
Member
Author
There was a problem hiding this comment.
Yes depending on the token type of the agent
Contributor
There was a problem hiding this comment.
Yup, for deployed conversational agents (in shared folders) running with user-token, CAS will start them with RunAsMe=true, so this is intended
dsuresh-ap
force-pushed
the
feature/run-as-me-propagation-JAR-9434
branch
from
39f1e91 to
c1cc71e
Compare
For conversational agents with a user token, automatically set RunAsMe=True on child StartJobs calls so API Workflows execute under the user's identity instead of requiring an unattended robot. Computes run_as_me top-down in tool_factory using agent.is_conversational and JWT sub_type, then passes it to create_process_tool. JAR-9434 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
dsuresh-ap
force-pushed
the
feature/run-as-me-propagation-JAR-9434
branch
from
e0ef642 to
98efb39
Compare
maxduu
approved these changes
Apr 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sub_type == "user"), automatically passRunAsMe=Trueto child StartJobs calls_should_run_as_me()helper that checks JWT token type +isConversationalconfig, cached per process lifetimerun_as_meparam toProcessesService)Context
JAR-9434 — Conversational Agent API Workflow tools fail with HTTP 409 ("no unattended robot") because RunAsMe is not propagated to child StartJobs calls. This PR detects user identity from the JWT token and conversational agent config, then propagates RunAsMe accordingly.
Test plan
test_run_as_me_true_for_conversational_user_token— user token + conversational → RunAsMe=Truetest_run_as_me_none_for_non_user_token— robot token → RunAsMe=None (no change)test_run_as_me_none_for_non_conversational_agent— autonomous agent → RunAsMe=None (no change)🤖 Generated with Claude Code