{"record":{"id":"5239169ec1891a13","repo":"hashicorp/nomad","slug":"invalid-variable-capability-s-in-namespace-s","errorCode":null,"errorMessage":"Invalid variable capability '%s' in namespace %s","messagePattern":"Invalid variable capability '(.+?)' in namespace (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":607,"sourceCode":"\t\t// Expand implicit capabilities\n\t\texpandNamespaceCapabilities(ns)\n\n\t\tif ns.Variables != nil {\n\t\t\tif len(ns.Variables.Paths) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid variable policy: no variable paths in namespace %s\", ns.Name)\n\t\t\t}\n\t\t\tfor _, pathPolicy := range ns.Variables.Paths {\n\t\t\t\tif pathPolicy.PathSpec == \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"Invalid missing variable path in namespace %s\", ns.Name)\n\t\t\t\t}\n\t\t\t\tif strings.HasPrefix(pathPolicy.PathSpec, \"/\") {\n\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\"Invalid variable path %q in namespace %s: cannot start with a leading '/'`\",\n\t\t\t\t\t\tpathPolicy.PathSpec, ns.Name)\n\t\t\t\t}\n\t\t\t\tfor _, cap := range pathPolicy.Capabilities {\n\t\t\t\t\tif !isPathCapabilityValid(cap) {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\t\"Invalid variable capability '%s' in namespace %s\", cap, ns.Name)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tpathPolicy.Capabilities = expandVariablesCapabilities(pathPolicy.Capabilities)\n\n\t\t\t}\n\t\t}\n\n\t\t// Remove the namespace name from the extra key list.\n\t\tp.removeExtraKey(ns.Name)\n\t}\n\n\tfor _, np := range p.NodePools {\n\t\tif !validNodePool.MatchString(np.Name) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid node pool name '%s'\", np.Name)\n\t\t}\n\t\tif np.Policy != \"\" && !isPolicyValid(np.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid node pool policy '%s' for '%s'\", np.Policy, np.Name)","sourceCodeStart":589,"sourceCodeEnd":625,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L589-L625","documentation":"Returned by acl.Parse in acl/policy.go:607 when a variables path block lists a capability not accepted by isPathCapabilityValid (acl/policy.go:314). Variables path capabilities are limited to write, read, list, destroy, and deny; any other string (including namespace capabilities like submit-job) is rejected.","triggerScenarios":"Calling acl.Parse with path { capabilities = [...] } in a variables stanza containing values outside {read, write, list, destroy, deny} — misspellings, uppercase forms, or namespace/node-pool capabilities pasted into a variables path.","commonSituations":"Copy-pasting namespace capabilities into variables stanzas; typos like 'delete' (correct word is 'destroy'); uppercase 'READ'; generators reusing a generic capability enum.","solutions":["Use only read, write, list, destroy, or deny in variables path capabilities (exact lowercase)","Replace 'delete' with 'destroy' (most common confusion)","Move non-variable capabilities into the namespace stanza's capabilities list","Pre-validate each capability against the fixed set of five before calling Parse"],"exampleFix":"// before\nvariables {\n  path \"secret/app\" {\n    capabilities = [\"read\", \"delete\"]\n  }\n}\n// after\nvariables {\n  path \"secret/app\" {\n    capabilities = [\"read\", \"destroy\"]\n  }\n}","handlingStrategy":"validation","validationCode":"var validVarCaps = map[string]bool{\"read\": true, \"write\": true, \"list\": true, \"destroy\": true, \"deny\": true}\nfor _, ns := range policy.Namespaces {\n    if ns.Variables == nil { continue }\n    for _, p := range ns.Variables.Paths {\n        for _, c := range p.Capabilities {\n            if !validVarCaps[c] { return fmt.Errorf(\"bad variables capability %q\", c) }\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Restrict variables path capabilities to read/write/list/destroy/deny","Remember 'delete' does not exist for variables — it is 'destroy'","Lint policies per stanza type with its own capability enum"],"tags":["nomad","acl","variables","capabilities"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}