cel_cost

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

The estimated worst-case cost of a when or measure is more than 100,000 units. Deedglass evaluates every condition inline, before the action runs, so the cost of each one is bounded when the policy compiles. CEL can’t know how long a list will be, so the estimate assumes up to 1,024 entries for each list in args; a loop inside a loop over arguments is about a million steps.

deedglass: policy/v1
name: orders
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: distinct-items
    match: { tool: shop.create_order }
    when: args.items.all(a, args.items.all(b, a != b))
    decision: allow

✕ policy.yaml:9:11 · cel_cost
  This condition could cost up to 113,252,355 units per call; the limit is 100,000.
  hint: Iterate a smaller list (sql.tables has at most 64 entries), avoid a loop inside a loop over args, or split the rule.

Fix: iterate one list at a time, like when: args.items.all(i, i.sku != "gift-card"). The estimate uses the size hints, not the conditions around the loop, so adding size(args.items) <= 20 && in front of a nested loop does not lower it.

cel_cost

Related