Skip to content
deedglassdocs

cel_constant_required

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

glob() was given a pattern, or minor() an amount, that is not a constant string. Like matches() patterns, these come from the policy, so an agent can’t choose what a rule matches.

deedglass: policy/v1
name: refunds
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: allowed-tools
    when: glob(tool.name, args.pattern)
    decision: allow
✕ policy.yaml:8:27 · cel_constant_required
  glob() needs a constant pattern.
  hint: Patterns come from the policy, never from an agent's arguments: write it in quotes, like glob(tool.name, "stripe.*")

Fix:

    when: glob(tool.name, "stripe.*")
Section titled “Related”