{"record":{"id":"0eda11847edbb1fe","repo":"bazelbuild/bazel","slug":"flag-value-s-for-s-is-not-allowed-by-invocatio","errorCode":null,"errorMessage":"Flag value '%s' for %s is not allowed by invocation policy. %sed values are: %s","messagePattern":"Flag value '(.+?)' for (.+?) is not allowed by invocation policy\\. (.+?)ed values are: (.+?)","errorType":"exception","errorClass":"OptionsParsingException","httpStatus":null,"severity":"error","filePath":"src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java","lineNumber":866,"sourceCode":"        ImmutableList.Builder<OptionAndRawValue> invocationPolicyFlagListBuilder)\n        throws OptionsParsingException {\n      OptionDefinition option = optionDescription.getOptionDefinition();\n      if (optionDescription.getOptionDefinition().allowsMultiple()) {\n        // allowMultiple requires that the type of the option be List<T>, so cast from Object\n        // to List<?>.\n        List<?> optionValues = (List<?>) valueDescription.getValue();\n        for (Object value : optionValues) {\n          if (!isFlagValueAllowed(convertedPolicyValues, value)) {\n            if (useDefault) {\n              applyUseDefaultOperation(\n                  parser,\n                  policyType + \"Values\",\n                  option,\n                  loglevel,\n                  conversionContext,\n                  invocationPolicyFlagListBuilder);\n            } else {\n              throw new OptionsParsingException(\n                  String.format(\n                      \"Flag value '%s' for %s is not allowed by invocation policy. %sed values \"\n                          + \"are: %s\",\n                      value, option, policyType, policyValues));\n            }\n          }\n        }\n\n      } else {\n\n        if (!isFlagValueAllowed(convertedPolicyValues, valueDescription.getValue())) {\n          if (newValue != null) {\n            logger.at(loglevel).log(\n                \"Overriding disallowed value '%s' for %s with value '%s' \"\n                    + \"specified by invocation policy. %sed values are: %s\",\n                valueDescription.getValue(), option, newValue, policyType, policyValues);\n            parser.clearValue(option);\n            parser.setOptionValueAtSpecificPriorityWithoutExpansion(origin, option, newValue);","sourceCodeStart":848,"sourceCodeEnd":884,"githubUrl":"https://github.com/bazelbuild/bazel/blob/e6e199d0601a244511b4cf18c8b2828aa73db1fd/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java#L848-L884","documentation":"Thrown in checkUserValue (repeatable-flag branch) when one of the user's accumulated values for a multiple-use flag is not in the policy-allowed set (allow_values) or is in the disallowed set (disallow_values), and no use_default fallback applies. Each element of the flag's list value is checked individually via isFlagValueAllowed.","triggerScenarios":"User passes a repeatable flag (e.g. --define-style / list flag) multiple times where at least one value is outside the policy's allowedValues or inside disallowedValues, and the policy has no useDefault (and no newValue, per the branch order).","commonSituations":"CI policies restricting list flags (e.g. only certain --features allowed) while user .bazelrc or scripts append broader values, partial migration where some tooling still passes legacy values, policy allow-lists drifting out of sync with new valid values.","solutions":["Remove or replace the disallowed value(s) from the command line / .bazelrc / wrapper script for that flag.","If the value is legitimately needed, ask the policy owner to add it to allowedValues (or remove it from disallowedValues).","Diff the flag values the environment injects (bazel's --announce_rc) against the allowed set printed in the error message."],"exampleFix":"# before (policy allows only thinlto)\n--features=thinlto --features=legacy-opt\n\n# after\n--features=thinlto","handlingStrategy":"validation","validationCode":"// Wrapper-side: check every accumulated value of a repeatable flag against the policy set\nSet<String> allowed = loadPolicyAllowedValues(flagName);\nboolean allAllowed = userValuesFor(flagName).stream().allMatch(allowed::contains);\nif (!allAllowed) throw new IllegalArgumentException(\"Values outside policy for \" + flagName);","typeGuard":null,"tryCatchPattern":"Catch OptionsParsingException; parse the '%sed values' list from the message (or load the policy directly) and diff it against the flag's accumulated values from the command line, project .bazelrc, and user ~/.bazelrc to find the violator.","preventionTips":["Use --announce_rc to see every value a repeatable flag accumulates before policy checks it","Keep .bazelrc entries for restricted list flags in sync with the policy allow-list","Policy owners: add use_default or newValue to auto-remap instead of hard-failing"],"tags":["invocation-policy","repeatable-flags","value-validation","bazel"],"backgroundTag":null,"analyzedSha":"e6e199d0601a244511b4cf18c8b2828aa73db1fd","analyzedAt":"2026-08-14T10:24:27.848Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}