BadUserAccessDenied (0x801F0000) — User does not have permission

Authentication succeeded but authorization did not. The identity is known and the request is well-formed; the user simply is not allowed to perform that operation on that node.

Start free OPC UA → canonical

Diagnosis

When you hit this

Connecting anonymously to a server whose nodes require a named user.
Reading works and writing fails, because the role has read but not write on that node.
A server that grants access by security policy — anonymous over an unencrypted endpoint is often read-only by design.

Resolution

How to fix it

Supply a real identity
Switch from anonymous to username/password or certificate identity. Anonymous is frequently read-only or browse-only.
Check per-node permissions
Access rights are per-node. Blanket read access does not imply write access on the same node.
Use a secure endpoint
Many servers only grant write permissions over Sign or SignAndEncrypt endpoints, never over None.

Normalization

What Forge does about it

This is a configuration or addressing mistake on the wire, upstream of anything Forge sees. Where Forge helps is the step after you fix it: once the point returns data, its vendor tag name maps to a canonical field automatically, so you do not also have to hand-maintain a name table for every point you just re-addressed.