What causes "external credential access is disabled for {}" in Hmbown/CodeWhale?

Change the policy for that provider to the allowed access mode in config.toml

external credential access is disabled for

Error message

external credential access is disabled for {}

What it means

Thrown by validate_read_scope when the ExternalCredentialsPolicy for a provider has access = Disabled: reading that provider's externally stored credentials is turned off entirely, so read_grant refuses to serve them. This is a deliberate policy gate, not a lookup failure — the credential may exist but the configuration forbids access.

Solutions

Change the policy for that provider to the allowed access mode in config.toml
If access should remain disabled, provide the credential inline instead of reading externally
Confirm with the machine/organization owner that enabling external access is intended
Restart/reload after editing the config so the new policy takes effect

Example fix

// before (config.toml)
[external_credentials.openai]
access = "disabled"
// after (config.toml)
[external_credentials.openai]
access = "read"

Defensive patterns

Strategy: try-catch

Validate before calling

// Inspect the effective policy before calling read_grant
let policy = load_external_credentials_policy(provider)?;
if policy.access == ExternalCredentialAccess::Disabled {
    // skip external read; supply credential another way
}

Try / catch

match read_grant(provider, source, &path) {
    Err(e) if e.to_string().contains("disabled") => fallback_to_inline_credential(provider),
    other => other?,
}

Prevention

Check the access policy in config before relying on external credentials
Document for your team which access mode each machine uses
Provide inline credentials where external access is disabled by policy

When it happens

Trigger: read_grant(provider, source, path) where config sets external credential access to "disabled" for that provider; enterprise/managed settings disabling external credential reads by default.

Common situations: Fresh installs or hardened profiles where external credential access ships disabled; users expecting CLI tools to read keychain/env credentials while policy blocks it.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/8f1558f798e702a0. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/external_credentials.rs:363

            source,
            path,
            consent_version: EXTERNAL_CREDENTIAL_CONSENT_VERSION,
        }
    }

    /// Validate that this record is a current read-only consent for one exact
    /// provider/source/path tuple without minting an I/O capability.
    ///
    /// This is intentionally side-effect free so inventory and picker surfaces
    /// can acknowledge dormant consent without inspecting the external file.
    pub fn validate_read_scope(
        &self,
        provider: ProviderKind,
        source: ExternalCredentialSource,
        resolved_path: &Path,
    ) -> Result<()> {
        if self.access == ExternalCredentialAccess::Disabled {
            bail!(
                "external credential access is disabled for {}",
                provider.as_str()
            );
        }
        if self.access == ExternalCredentialAccess::Managed {
            bail!(
                "managed external credential access is unsupported for {}; no schema-safe preservation adapter is available",
                provider.as_str()
            );
        }
        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {
            bail!(
                "external credential consent for {} uses unsupported version {}; revoke and consent again",
                provider.as_str(),
                self.consent_version
            );
        }
        if self.provider != provider.as_str() {

View on GitHub (pinned to 73e0f67d83)