Policy diagnostics
Every diagnostic from deedglass policy lint and the policy routes has a stable code and a doc_url that opens its page here. An error means the policy is not accepted; a warning means it is accepted and you should look at that line.
| Code | Severity | What it means |
|---|---|---|
file_too_large |
error | The file is larger than 256 KiB. Deedglass checks the size before it reads any YAML, so a very large file can’t slow down the compiler or… |
yaml_syntax |
error | The file is not valid YAML, or it is not valid UTF-8. The most common cause is a when with : in it, which YAML reads as a new key. |
yaml_tab_indent |
error | A line is indented with a tab. YAML does not allow tabs for indentation, and a tab can look like any number of spaces in an editor, so… |
yaml_alias |
error | The file uses a YAML anchor (&name) or alias (*name). An alias makes one rule depend on text somewhere else in the file, so a reviewer… |
yaml_merge_key |
error | The file uses a YAML merge key (<<). Like an alias, a merge key hides part of a rule somewhere else, so Deedglass refuses it. |
yaml_tag |
error | A value starts with !, which YAML reads as a tag. Policies use plain YAML values only; the YAML 1.2 core tags (!!str, !!int and so on) are… |
yaml_multi_document |
error | The file holds more than one YAML document, separated by —. One file is one policy, so what you review is exactly what is stored. |
yaml_duplicate_key |
error | A key appears twice in the same mapping. Most YAML readers keep only one of the two values without telling you, so the file would mean… |
yaml_too_complex |
error | The YAML nests more than 32 levels deep, or has more than 50,000 nodes (every key, value and list entry is a node). A real policy needs a… |
missing_marker |
error | The file has no deedglass: policy/v1 key, or it is empty. The marker names the format, so Deedglass and your editor know the file is a… |
unsupported_format |
error | The marker names a format this version of Deedglass does not read, like policy/v2, or something that is not a policy format at all. |
unknown_key |
error | A key is not part of the language at that place. Deedglass refuses unknown keys instead of ignoring them, because a misspelled key would… |
missing_key |
error | A required key is missing: name or defaults at the top level, decision in defaults, id or decision in a rule, or id, window or a limit… |
wrong_type |
error | A value has the wrong shape: text where a mapping belongs, a list where a single value belongs, a quoted number where a whole number… |
conflicting_keys |
error | Two keys can’t be used together. A budget limits either calls (maxcalls) or spending (maxspend), not both, and measure only works with… |
invalid_name |
error | The policy name is not a slug. A name is 2 to 63 characters of lowercase ASCII letters, digits and dashes, starting with a letter, so it… |
invalid_id |
error | A rule or budget id is not a slug. Ids follow the same rules as names, because they appear in deny messages, in deeds and in the Ledger. |
duplicate_id |
error | Two rules, two budgets, or a rule and a budget share an id. Budgets and rules share one set of ids, so a decision always names exactly one… |
too_many_rules |
error | The policy has more than 500 rules. Rules are read top to bottom, and a person reviewing the file has to be able to follow them. A policy… |
too_many_budgets |
error | The policy has more than 50 budgets. Every budget is checked for every action, so the limit keeps evaluation fast. A policy with 51… |
too_many_values |
error | A list has more than 32 entries. The limit applies to each match list (tool, connectortype, sideeffect, agent), to labels, to approvers… |
value_too_long |
error | A description is longer than 1,000 characters. A policy whose description is 1,011 characters gets: |
invalid_decision |
error | A decision is not allow, deny or require_approval. The hint maps common words (block, reject, approve, permit and others) to the decision… |
invalid_value |
error | A field that takes one of a fixed set of values has something else: verify (L0, L1, L2), a budget’s per (agent, org) or window (minute… |
out_of_range |
error | A whole number is outside its range: max_calls is 1 to 1,000,000,000, and an approval’s required is 1 to 5. |
reason_missing |
error | A rule (or defaults) denies or requires approval but has no reason. The reason is the one sentence the agent, and the person who approves… |
control_character |
error | A string contains a control character, a bidirectional control character or an invisible formatting character (like U+200B, a zero-width… |
invalid_glob |
error | A pattern in match (or in a glob() call) is not a valid glob. Globs use and ? only, with letters, digits and . : -; they are at most 200… |
invalid_side_effect |
error | A side_effect in match is not read, write, destructive or unknown. These are the values tools declare, so no globs are allowed here. |
invalid_label |
error | A label in match.labels is not valid. Keys use lowercase letters, digits and . _ / - (up to 63 characters, starting with a letter or… |
invalid_duration |
error | An approval’s expires_in is not a duration, or is outside 1m to 7d. A duration is a whole number and one unit: s, m, h or d. |
money_float |
error | An amount of money is a YAML number. YAML numbers are floating point, and 0.1 + 0.2 is not 0.3 in floating point, so money is always a… |
invalid_money |
error | A money string is not “ |
unknown_currency |
error | The currency is not an active ISO 4217 code. The code is three letters, in any case; fmt writes it in lowercase. |
money_precision |
error | The amount has more decimals than the currency’s minor unit: 2 for usd and inr, 0 for jpy, 3 for kwd. Deedglass never rounds money for… |
invalid_approvers |
error | An entry in approvers is not role:owner, role:admin or user: |
approvals_unsatisfiable |
error | An approval needs more approvals than the people it names. When every approver is a user:, required can be at most the number of distinct… |
cel_syntax |
error | A when or measure is not valid CEL. The hint covers the two most common slips: = instead of ==, and and, or or not instead of &&, || or !.… |
cel_undeclared |
error | An expression uses a name that is not one of the policy variables: tool, args, request, sql, agent, user, session, org, time, usage and… |
cel_no_field |
error | An expression reads a field that its variable does not have. Every variable except args is declared field by field, so a typo is an error… |
cel_type |
error | An expression does not type-check: an operator or function is applied to values of the wrong types. The most common case is comparing a… |
cel_not_bool |
error | A when returns something other than true or false, like a string. A condition whose type is only known at run time (dyn, like args.flag)… |
cel_not_int |
error | A budget’s measure returns something other than a whole number. A spending budget counts minor units, so measure must return an int (or… |
cel_cost |
error | The estimated worst-case cost of a when or measure is more than 100,000 units. Deedglass evaluates every condition inline, before the… |
cel_nesting |
error | Comprehensions (all, exists, exists_one, map, filter) are nested more than 2 deep. Deeply nested loops are hard to read and multiply the… |
cel_too_long |
error | A when or measure is longer than 4,096 characters. A long expression is usually a long list of values written inline. A when of 5,281… |
cel_regex |
error | The pattern in matches() is not a constant string, is longer than 256 characters, or is not valid RE2. Patterns come from the policy… |
cel_constant_required |
error | glob() was given a pattern, or minor() an amount, that is not a constant string. Like matches() patterns, these come from the policy, so… |
reason_too_long |
warning | A reason is longer than 280 characters. The policy is accepted, but agents and approvers see at most 280 characters, so the end of the… |
unknown_connector_type |
warning | A connectortype in match is not a known connector type. The policy is accepted, because new connector types can be added later, but a… |
ignored_field |
warning | A rule sets a field its decision does not use: approval on anything but require_approval, notify on allow, or verify on deny. The policy… |
rule_unreachable |
warning | An earlier rule with no when matches everything a later rule matches, so the first match always comes from the earlier rule and the later… |
default_allow |
warning | defaults.decision is allow, so every action no rule matches runs, including tools added after you wrote the policy. The policy is… |
secret_in_policy |
warning | A line looks like an API key or token (for example a Deedglass, Stripe, GitHub, Slack or AWS key). Policies are stored, versioned and… |
reason_style |
warning | A reason does not follow the Deedglass voice: it has an exclamation mark, starts with a lowercase letter, does not end with a period, or… |
more_diagnostics |
error | The file has more than 50 diagnostics. Deedglass reports the first 50, sorted by position, and then this one entry, which counts the rest.… |
internal_compiler_error |
error | The compiler itself failed on this file. This is a bug in Deedglass, not in your policy. A policy that can’t be compiled is never… |