{"record":{"id":"521eaae6e9260216","repo":"bazelbuild/bazel","slug":"default-flag-value-s-for-s-is-not-allowed-by-i","errorCode":null,"errorMessage":"Default flag value '%s' for %s is not allowed by invocation policy, but the policy does not provide a new value. %sed values are: %s","messagePattern":"Default flag value '(.+?)' for (.+?) is not allowed by invocation policy, but the policy does not provide a new value\\. (.+?)ed values are: (.+?)","errorType":"exception","errorClass":"OptionsParsingException","httpStatus":null,"severity":"error","filePath":"src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java","lineNumber":827,"sourceCode":"          convertedPolicyValues, optionDefinition.getDefaultValue(conversionContext))) {\n        if (newValue != null) {\n          // Use the default value from the policy, since the original default is not allowed\n          logger.at(loglevel).log(\n              \"Overriding default value '%s' for %s with value '%s' specified by invocation \"\n                  + \"policy. %sed values are: %s\",\n              optionDefinition.getDefaultValue(conversionContext),\n              optionDefinition,\n              newValue,\n              policyType,\n              policyValues);\n          parser.clearValue(optionDefinition);\n          parser.setOptionValueAtSpecificPriorityWithoutExpansion(\n              origin, optionDefinition, newValue);\n          invocationPolicyFlagListBuilder.add(\n              OptionAndRawValue.create(optionDefinition.getOptionName(), newValue));\n        } else {\n          // The operation disallows the default value, but doesn't supply a new value.\n          throw new OptionsParsingException(\n              String.format(\n                  \"Default flag value '%s' for %s is not allowed by invocation policy, but \"\n                      + \"the policy does not provide a new value. %sed values are: %s\",\n                  optionDescription.getOptionDefinition().getDefaultValue(conversionContext),\n                  optionDefinition,\n                  policyType,\n                  policyValues));\n        }\n      }\n    }\n\n    void checkUserValue(\n        OptionsParser parser,\n        OptionInstanceOrigin origin,\n        OptionDescription optionDescription,\n        OptionValueDescription valueDescription,\n        List<String> policyValues,\n        String newValue,","sourceCodeStart":809,"sourceCodeEnd":845,"githubUrl":"https://github.com/bazelbuild/bazel/blob/e6e199d0601a244511b4cf18c8b2828aa73db1fd/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java#L809-L845","documentation":"Thrown in checkDefaultValue when an allow_values/disallow_values policy forbids the flag's default value, the user did not set the flag, and the policy supplies no replacement (no newValue, no use_default). The default cannot stay (disallowed) and nothing tells the enforcer what to use instead, so parsing fails. The message lists the policyType ('Allow'/'Disallow' rendered as '%sed values') and the permitted value set.","triggerScenarios":"Policy {\"flagName\":\"compilation_mode\",\"allowValues\":{\"allowedValues\":[\"opt\"]}} with the flag's default 'fastbuild' and the user not passing the flag: default is checked, disallowed, no newValue/useDefault present -> throw.","commonSituations":"Org policy restricting a flag without considering that everyone who never sets the flag will now hard-fail, rolling out value restrictions to a large repo where most users rely on defaults, version changes that alter a flag's default value after the policy was written.","solutions":["Add newValue to the allow/disallow operation so the default is replaced (e.g. disallowValues with newValue=['opt']).","Or add useDefault only if the default itself is allowed (see related contradiction error otherwise).","Or widen the allowed set to include the flag's default.","Communicate the forced value to users so their builds don't change silently."],"exampleFix":"// before (default fastbuild is not in allowed set, no fallback)\n{\"flagName\":\"compilation_mode\",\"allowValues\":{\"allowedValues\":[\"opt\"]}}\n\n// after\n{\"flagName\":\"compilation_mode\",\"allowValues\":{\"allowedValues\":[\"opt\"],\"newValue\":[\"opt\"]}}","handlingStrategy":"validation","validationCode":"// Lint: if the default is disallowed, policy must supply newValue or use_default (with default allowed)\nObject def = optionDefinition.getDefaultValue(ctx);\nif (!isValueAllowedByPolicy(fp, def)\n    && !hasNewValue(fp)\n    && !usesUseDefault(fp)) {\n  throw new IllegalStateException(\"Policy forbids default of '\" + flagName + \"' with no fallback\");\n}","typeGuard":null,"tryCatchPattern":"Catch OptionsParsingException; add newValue to the allow/disallow operation so unset users get a valid replacement automatically.","preventionTips":["Always supply newValue when restricting a flag whose default is outside the allowed set","Consider users who never set the flag when authoring value restrictions","Re-check defaults after Bazel upgrades, since defaults can change between versions"],"tags":["invocation-policy","default-values","allow-values","bazel"],"backgroundTag":null,"analyzedSha":"e6e199d0601a244511b4cf18c8b2828aa73db1fd","analyzedAt":"2026-08-14T10:24:27.848Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}