Invalid allowed role metadata

Error message

Invalid allowed role metadata: {}. Allowed values are 'all' or 'none' or an array of roles.

What it means

The `allowed_role_metadata` value, when given as a single string, must be exactly 'all' or 'none'; anything else (when not an array of roles) is rejected. Arrays of roles are accepted via the Only variant.

Solutions

Use the exact strings 'all' or 'none', or provide an array of roles.
Fix casing/typos in the metadata value.
If you meant a single role restriction, wrap it as a one-element array.

Example fix

// before
allowed_role_metadata "everything"
// after
allowed_role_metadata "all"
// or
allowed_role_metadata ["system", "user"]

Defensive patterns

Strategy: validation

Validate before calling

if (typeof meta === "string" && !['all', 'none'].includes(meta) && !Array.isArray(meta)) {
  throw new Error(`allowed_role_metadata must be 'all', 'none', or an array, got: ${meta}`);
}

Prevention

Use only the exact literals 'all'/'none' or role arrays.
Add schema validation for prompt metadata fields.

When it happens

Trigger: Resolving a prompt/chat role metadata attribute whose string value is neither 'all', 'none', nor a valid roles array — e.g. allowed_role_metadata "everything".

Common situations: Misspelling 'all'/'none' (wrong case, extra words) or passing a single role string where an array is expected.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/40d6bbecca4d50cf. Report an issue: GitHub.

Appendix: source

Thrown at engine/baml-lib/llm-client/src/clientspec.rs:476

    pub fn required_env_vars(&self) -> HashSet<String> {
        match self {
            Self::Value(role) => role.required_env_vars(),
            Self::Only(roles) => roles
                .iter()
                .flat_map(|role| role.required_env_vars())
                .collect(),
            _ => HashSet::new(),
        }
    }

    pub fn resolve(&self, ctx: &impl GetEnvVar) -> Result<AllowedRoleMetadata> {
        match self {
            Self::Value(role) => {
                let role = role.resolve(ctx)?;
                match role.as_str() {
                    "all" => Ok(AllowedRoleMetadata::All),
                    "none" => Ok(AllowedRoleMetadata::None),
                    _ => Err(anyhow::anyhow!("Invalid allowed role metadata: {}. Allowed values are 'all' or 'none' or an array of roles.", role)),
                }
            }
            Self::All => Ok(AllowedRoleMetadata::All),
            Self::None => Ok(AllowedRoleMetadata::None),
            Self::Only(roles) => Ok(AllowedRoleMetadata::Only(
                roles
                    .iter()
                    .map(|role| role.resolve(ctx))
                    .collect::<Result<Vec<_>>>()?,
            )),
        }
    }
}

impl AllowedRoleMetadata {
    pub fn is_allowed(&self, key: &str) -> bool {
        match self {
            Self::All => true,

View on GitHub (pinned to bd85ce9dee)