Skip to content
deedglassdocs

rule_unreachable

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: warning

An earlier rule with no when matches everything a later rule matches, so the first match always comes from the earlier rule and the later one never decides anything. The policy is accepted. Deedglass only warns when this is certain from match.

deedglass: policy/v1
name: refunds
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: stripe-reads
    match: { tool: "stripe.*" }
    decision: allow
  - id: block-refunds
    match: { tool: stripe.create_refund }
    decision: deny
    reason: Refunds are never made by agents.
○ policy.yaml:10:5 · rule_unreachable
  Rule "block-refunds" can never match: rule "stripe-reads" (line 7) matches everything it does and has no when.
  hint: Move rule "block-refunds" above rule "stripe-reads", or narrow rule "stripe-reads".

Fix: put the narrower rule first.

rules:
  - id: block-refunds
    match: { tool: stripe.create_refund }
    decision: deny
    reason: Refunds are never made by agents.
  - id: stripe-reads
    match: { tool: "stripe.*" }
    decision: allow
Section titled “Related”