{"record":{"id":"1da5cdb433f379bf","repo":"run-llama/llama_index","slug":"query-requires-invoker-identity-but-none-provided","errorCode":null,"errorMessage":"Query requires invoker identity but none provided","messagePattern":"Query requires invoker identity but none provided","errorType":"exception","errorClass":"PermissionError","httpStatus":null,"severity":"error","filePath":"llama-index-integrations/agent/llama-index-agent-agentmesh/llama_index/agent/agentmesh/query_engine.py","lineNumber":154,"sourceCode":"            query_bundle: The query to execute\n            invoker_card: Optional invoker card for verification\n            **kwargs: Additional arguments\n\n        Returns:\n            Query response\n\n        Raises:\n            PermissionError: If trust verification fails\n\n        \"\"\"\n        verification = None\n        query_text = query_bundle.query_str\n\n        # Verify invoker if required\n        if self._policy.require_verification:\n            if not invoker_card:\n                if self._data_policy.require_identity:\n                    raise PermissionError(\n                        \"Query requires invoker identity but none provided\"\n                    )\n            else:\n                verification = self.verify_invoker(invoker_card)\n                if not verification.trusted and self._policy.block_unverified:\n                    # Log blocked query\n                    if self._policy.audit_queries:\n                        record = self._create_audit_record(\n                            query_text, invoker_card, verification\n                        )\n                        record.warnings.append(\"Query blocked due to trust failure\")\n                        self._audit_log.append(record)\n\n                    raise PermissionError(f\"Query rejected: {verification.reason}\")\n\n        # Execute the underlying query\n        response = self._query_engine.query(query_bundle)\n","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/run-llama/llama_index/blob/afd0fef371831f9bda13e5af7167cf4e981278ab/llama-index-integrations/agent/llama-index-agent-agentmesh/llama_index/agent/agentmesh/query_engine.py#L136-L172","documentation":"Raised by AgentMeshQueryEngine.query (sync path) when the configured policy demands verified invokers (policy.require_verification is true) and the data policy requires identity (data_policy.require_identity is true), but the caller passed no invoker_card. The engine treats an anonymous query against identity-required data as a permission violation and raises PermissionError before executing the underlying query engine.","triggerScenarios":"Calling query_engine.query(query_bundle) — or the str-based convenience wrapper that forwards invoker_card=None — on an AgentMeshQueryEngine built with require_verification=True and require_identity=True without supplying an invoker agent card.","commonSituations":"Sharing a query engine whose policies were tightened after code was written so existing call sites no longer pass invoker_card; a new team member running queries without obtaining an agent identity card; misreading require_identity as applying only to writes, not reads.","solutions":["Pass a valid invoker card: query_engine.query(query, invoker_card=my_agent_card)","If anonymous reads are intended, build the engine with data_policy.require_identity=False","If verification is not needed at all, set policy.require_verification=False"],"exampleFix":"# before\nresponse = engine.query(\"summary of Q3 data\")  # PermissionError\n\n# after\nresponse = engine.query(\"summary of Q3 data\", invoker_card=invoker.identity_card)","handlingStrategy":"validation","validationCode":"def can_query_anonymously(engine) -> bool:\n    policy = engine._policy\n    data_policy = engine._data_policy\n    return not (policy.require_verification and data_policy.require_identity)","typeGuard":"def is_invoker_card(card) -> bool:\n    \"\"\"Narrow an optional invoker card to a usable object.\"\"\"\n    return card is not None and getattr(card, \"agent_name\", None) is not None","tryCatchPattern":"try:\n    resp = engine.query(q)\nexcept PermissionError as e:\n    if \"none provided\" in str(e):\n        raise PermissionError(\"engine requires identity; supply invoker_card\") from e\n    raise","preventionTips":["Pass invoker_card at every call site when policies may require identity","Centralize engine construction so require_identity/require_verification policy is explicit and documented","Add a startup assertion that call sites have credentials when require_identity is on"],"tags":["permissions","identity","query-engine","agent-mesh","authorization"],"backgroundTag":null,"analyzedSha":"afd0fef371831f9bda13e5af7167cf4e981278ab","analyzedAt":"2026-08-15T05:42:58.429Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}