Skip to content
deedglassdocs

cel_regex

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

The pattern in matches() is not a constant string, is longer than 256 characters, or is not valid RE2. Patterns come from the policy author, never from the agent’s arguments, and they are checked when the policy compiles.

deedglass: policy/v1
name: email
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: acme-recipients
    match: { tool: gmail.send }
    when: args.to.matches(args.pattern)
    decision: allow
✕ policy.yaml:9:27 · cel_regex
  The pattern in matches() must be a constant string.
  hint: Patterns come from the policy, never from an agent's arguments: write the pattern in quotes.

Fix:

    when: args.to.matches("^[a-z.]+@acme[.]com$")
Section titled “Related”