Skip to content
deedglassdocs

invalid_decision

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

A decision is not allow, deny or require_approval. The hint maps common words (block, reject, approve, permit and others) to the decision you probably meant.

deedglass: policy/v1
name: postgres-safe
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: block-drop
    match: { tool: "postgres.*" }
    when: sql.kind == "drop"
    decision: block
    reason: DROP is never allowed for agents.
✕ policy.yaml:10:15 · invalid_decision
  block is not a decision.
  hint: Did you mean deny? Decisions are allow, deny and require_approval.

Fix:

    decision: deny
Section titled “Related”