Skip to content
deedglassdocs

invalid_approvers

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

An entry in approvers is not role:owner, role:admin or user:<email>. role:viewer is refused because viewers can’t approve.

deedglass: policy/v1
name: refunds
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: large-refunds
    match: { tool: stripe.create_refund }
    decision: require_approval
    reason: Refunds wait for a person.
    approval: { approvers: [priya@acme.com] }
✕ policy.yaml:11:29 · invalid_approvers
  priya@acme.com is not an approver.
  hint: Write it as user:priya@acme.com.

Fix:

    approval: { approvers: ["user:priya@acme.com"] }
Section titled “Related”