Hmbown/CodeWhale · error

approval_policy ' ' is not allowed by requirements ( )

Error message

approval_policy '{policy}' is not allowed by requirements ({})

What it means

The TUI config loader validates the user's `approval_policy` against an explicit allowlist in a requirements block. If the policy value (case-insensitively compared) is not present in `requirements.allowed_approval_policies`, configuration loading aborts rather than proceeding with an unapproved policy. This guards deployments where requirements restrict which approval modes are permitted.

Solutions

1. Set `approval_policy` to one of the allowed values listed in the error's parenthesized list
2. Remove or update the `requirements.allowed_approval_policies` restriction if the policy should be permitted
3. Fix the spelling/case of the policy in your config (matching is case-insensitive, so this is a value mistake not formatting)

Example fix

// before
approval_policy = "auto"
// after
approval_policy = "on-request"

let allowed = requirements.allowed_approval_policies.iter().any(|p| p.eq_ignore_ascii_case(&policy));
if requirements_has_allowlist && !allowed { eprintln!("policy {policy} not in {:?}", requirements.allowed_approval_policies); }

fn policy_allowed(policy: &str, requirements: &Requirements) -> bool {
    requirements.allowed_approval_policies.is_empty()
        || requirements.allowed_approval_policies.iter().any(|p| p.eq_ignore_ascii_case(policy))
}

When it happens

Trigger: Calling config validation with an `approval_policy` string (e.g. `untrusted`, `on-request`, `on-failure`, `never`) that is absent from a non-empty `requirements.allowed_approval_policies` list.

Common situations: Hand-edited config.toml with a typo'd or renamed approval policy; switching between Codewhale versions where a policy name changed; org-managed requirements files that whitelist only a subset of policies.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• agent profile provider cannot be empty
• agent profile provider must be a simple provider id
• api_key cannot be empty string
• budget document_kind must be
• bundle at is bytes; the limit is bytes

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/6d6f14c9683f0a24. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/config.rs:11741

    let contents = fs::read_to_string(&path)
        .with_context(|| format!("Failed to read requirements file: {}", path.display()))?;
    let requirements: RequirementsFile = toml::from_str(&contents).map_err(|_| {
        anyhow::anyhow!(
            "Failed to parse requirements file {}; file contents were omitted",
            codewhale_config::quote_os_path(&path)
        )
    })?;

    if !requirements.allowed_approval_policies.is_empty()
        && let Some(policy) = config.approval_policy.as_ref()
    {
        let policy = policy.to_ascii_lowercase();
        if !requirements
            .allowed_approval_policies
            .iter()
            .any(|p| p.eq_ignore_ascii_case(&policy))
        {
            anyhow::bail!(
                "approval_policy '{policy}' is not allowed by requirements ({})",
                requirements.allowed_approval_policies.join(", ")
            );
        }
    }
    if !requirements.allowed_sandbox_modes.is_empty()
        && let Some(mode) = config.sandbox_mode.as_ref()
    {
        let mode = mode.to_ascii_lowercase();
        if !requirements
            .allowed_sandbox_modes
            .iter()
            .any(|m| m.eq_ignore_ascii_case(&mode))
        {
            anyhow::bail!(
                "sandbox_mode '{mode}' is not allowed by requirements ({})",
                requirements.allowed_sandbox_modes.join(", ")
            );

View on GitHub (pinned to 73e0f67d83)