Skip to content
deedglassdocs

invalid_side_effect

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

A side_effect in match is not read, write, destructive or unknown. These are the values tools declare, so no globs are allowed here.

deedglass: policy/v1
name: postgres-safe
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: reads
    match: { tool: "postgres.*", side_effect: reads }
    decision: allow
✕ policy.yaml:8:47 · invalid_side_effect
  reads is not a side effect.
  hint: Did you mean read? Use read, write, destructive or unknown.

Fix:

    match: { tool: "postgres.*", side_effect: read }
Section titled “Related”