Skip to content
deedglassdocs

yaml_alias

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

The file uses a YAML anchor (&name) or alias (*name). An alias makes one rule depend on text somewhere else in the file, so a reviewer can’t read a rule on its own, and aliases can expand a small file into a very large one.

deedglass: policy/v1
name: refunds
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: small-refunds
    match: &refund { tool: stripe.create_refund }
    when: args.amount <= minor("50.00 usd")
    decision: allow
  - id: large-refunds
    match: *refund
    decision: require_approval
    reason: Refunds over $50.00 wait for a person.
✕ policy.yaml:8:12 · yaml_alias
  Anchors and aliases (& and *) are not allowed in policies.
  hint: Repeat the value, so each rule reads on its own.

Fix: write the value out in each place.

  - id: small-refunds
    match: { tool: stripe.create_refund }
    when: args.amount <= minor("50.00 usd")
    decision: allow
  - id: large-refunds
    match: { tool: stripe.create_refund }
    decision: require_approval
    reason: Refunds over $50.00 wait for a person.
Section titled “Related”