Skip to content
deedglassdocs

cel_not_bool

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

A when returns something other than true or false, like a string. A condition whose type is only known at run time (dyn, like args.flag) is accepted, and a value that turns out not to be a bool counts as an evaluation error, which never widens access.

deedglass: policy/v1
name: postgres-safe
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: selects
    match: { tool: "postgres.*" }
    when: sql.kind
    decision: allow
✕ policy.yaml:9:11 · cel_not_bool
  when must be true or false; this expression returns a string.
  hint: Compare it with something, like args.status == "open"

Fix:

    when: sql.kind == "select"
Section titled “Related”