Skip to content
deedglassdocs

cel_no_field

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

An expression reads a field that its variable does not have. Every variable except args is declared field by field, so a typo is an error when you lint, never a condition that is quietly false at run time.

deedglass: policy/v1
name: postgres-safe
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: block-drop
    match: { tool: "postgres.*" }
    when: sql.knid == "drop"
    decision: deny
    reason: DROP is never allowed for agents.
✕ policy.yaml:9:15 · cel_no_field
  sql has no field "knid".
  hint: Did you mean "kind"?

Fix:

    when: sql.kind == "drop"
Section titled “Related”