INSUFFICIENT_PERMISSION — what it means and how to fix it
INSUFFICIENT_PERMISSION: It means the role the script runs as does not have the permission, or the right level, for the record type or operation. Fix it by granting the permission to the role, raising its level, or setting the deployment to execute as Administrator where appropriate.
When you see this
- A SuiteScript fails with INSUFFICIENT_PERMISSION when reading, creating, or transforming a record.
- The script works for an administrator but fails for an end-user role.
- A scheduled or user-event script runs as a role that lacks a permission the code needs.
Causes
- The role executing the script does not have the relevant permission (e.g. Transactions > Sales Order), or has it at too low a level (View instead of Edit/Full).
- The script deployment's "Execute as Role" is set to the current user rather than a role with sufficient access.
Fix
Match the executing role's access to what the code actually does.
- Identify the role the script runs as (the user's role for client/user-event scripts, or the deployment's "Execute as Role" for scheduled/Suitelet scripts), then add the missing permission at the correct level on that role.
- Where the operation is genuinely administrative, set the script deployment's "Execute as Role" to Administrator so it has the required access, and restrict who can trigger it.
Prevent it
- Design scripts to run under a purpose-built role with least-privilege permissions, documented alongside the script.
- Test every script under the actual end-user role, not just as Administrator.
SuiteScript version note: Permission model is the same across SuiteScript 2.0 and 2.1; the error reflects NetSuite role configuration, not the API version.
Frequently asked questions
- Why does it work for me but not my users?
- You are almost certainly testing as Administrator. The script runs under the end-user's role, which lacks a permission your role has.
Last reviewed: by Wouter Nortje, CA