Skip to content
deedglassdocs

yaml_tag

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: error

A value starts with !, which YAML reads as a tag. Policies use plain YAML values only; the YAML 1.2 core tags (!!str, !!int and so on) are the only ones allowed. The usual cause is a CEL condition that starts with !.

deedglass: policy/v1
name: postgres-safe
defaults:
  decision: deny
  reason: No rule allows this action.
rules:
  - id: single-statements
    match: { tool: "postgres.*" }
    when: !sql.multi
    decision: allow
✕ policy.yaml:9:11 · yaml_tag
  !sql.multi is read by YAML as a tag, not as CEL.
  hint: Quote the expression: when: '!sql.multi'

Fix: quote the expression.

    when: '!sql.multi'
Section titled “Related”