Skip to content
deedglassdocs

cel_nesting

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

Comprehensions (all, exists, exists_one, map, filter) are nested more than 2 deep. Deeply nested loops are hard to read and multiply the cost of a condition.

deedglass: policy/v1
name: orders
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: no-gift-tags
    match: { tool: shop.create_order }
    when: args.orders.all(o, o.items.all(i, i.tags.all(t, t != "gift")))
    decision: allow
✕ policy.yaml:9:52 · cel_nesting
  Comprehensions are nested 3 deep; the limit is 2.
  hint: Flatten the condition, or split it into two rules.

Fix: check a flatter value, like a flag the tool sets on each order: when: args.orders.all(o, !o.gift).

Section titled “Related”