{"record":{"id":"5ffce0bb5828d284","repo":"bazelbuild/bazel","slug":"user-set-a-value-for-s-which-is-not-permitted-by","errorCode":null,"errorMessage":"User set a value for %s which is not permitted by the invocation policy. This flag value will always be overridden to %s. %s","messagePattern":"User set a value for (.+?) which is not permitted by the invocation policy\\. This flag value will always be overridden to (.+?)\\. (.+?)","errorType":"exception","errorClass":"OptionsParsingException","httpStatus":null,"severity":"error","filePath":"src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java","lineNumber":598,"sourceCode":"              \"Keeping value '%s' from source '%s' for %s because the invocation policy specifying \"\n                  + \"the value(s) '%s' is overridable\",\n              valueDescription.getValue(),\n              valueDescription.getSourceString(),\n              optionDefinition,\n              setValue.getFlagValueList());\n          // Nothing to do -- the value already has an override.\n          return;\n        }\n        break;\n      case FINAL_VALUE_IGNORE_OVERRIDES:\n        // Clear the value in case the flag is a repeated flag so that values don't accumulate.\n        parser.clearValue(flagPolicy.description.getOptionDefinition());\n        break;\n      case APPEND:\n        break;\n      case FINAL_VALUE_THROW_ON_OVERRIDE:\n        if (valueDescription != null) {\n          throw new OptionsParsingException(\n              String.format(\n                  \"User set a value for %s which is not permitted by the invocation policy. This\"\n                      + \" flag value will always be overridden to %s. %s\",\n                  optionDefinition,\n                  flagPolicy.policy.getSetValue().getFlagValueList(),\n                  flagPolicy.policy.getCustomErrorMessage()));\n        }\n        break;\n    }\n\n    // Set all the flag values from the policy.\n    for (String flagValue : setValue.getFlagValueList()) {\n      if (valueDescription == null) {\n        logger.at(loglevel).log(\n            \"Setting value for %s from invocation policy to '%s', overriding the default value \"\n                + \"'%s'\",\n            optionDefinition, flagValue, optionDefinition.getDefaultValue(conversionContext));\n      } else {","sourceCodeStart":580,"sourceCodeEnd":616,"githubUrl":"https://github.com/bazelbuild/bazel/blob/e6e199d0601a244511b4cf18c8b2828aa73db1fd/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java#L580-L616","documentation":"Thrown when set_value has behavior FINAL_VALUE_THROW_ON_OVERRIDE and the user explicitly set the flag on the command line. The policy's value is final; a user-supplied value conflicts, so parsing aborts rather than silently overriding. The message includes the option definition, the policy-mandated values, and any customErrorMessage the policy author set.","triggerScenarios":"Org policy pins a flag with FINAL_VALUE_THROW_ON_OVERRIDE; a developer then passes that flag on the command line (e.g. policy forces --compilation_mode=opt, user runs bazel build --compilation_mode=dbg).","commonSituations":"CI or corporate environments with enforced policies where local habits/scripts pass the locked flag, developer unaware the flag is locked, wrapper scripts unconditionally adding flags that are policy-pinned.","solutions":["Remove the user-supplied flag from the command line / script / .bazelrc and accept the policy value.","If you own the policy and the flag should be user-settable, change behavior to ALLOW_OVERRIDES.","If it must stay final but with a clearer failure, set custom_message on the policy entry so users see instructions in this very error.","Audit user-level .bazelrc files and aliases for the locked flag name."],"exampleFix":"# before (policy forces compilation_mode=opt, FINAL_VALUE_THROW_ON_OVERRIDE)\nbazel build --compilation_mode=dbg //...\n\n# after\nbazel build //...","handlingStrategy":"try-catch","validationCode":"// Wrapper-side guard: drop flags known to be policy-final before invoking bazel\nSet<String> policyLockedFlags = loadFromOrgPolicy();\nList<String> safeArgs = userArgs.stream()\n    .filter(a -> !policyLockedFlags.contains(flagNameOf(a)))\n    .collect(toList());","typeGuard":null,"tryCatchPattern":"Catch OptionsParsingException, detect the 'not permitted by the invocation policy' prefix, and fail with actionable guidance: name the locked flag and the policy-mandated value (both are in the message) and instruct removal of the user flag. Do not auto-strip and retry unless the wrapper owns the offending args.","preventionTips":["Publish the list of policy-final flags to all developers","Set customErrorMessage in the policy so this error self-documents the fix","Wrapper scripts should filter out locked flags instead of passing them blindly"],"tags":["invocation-policy","final-value","flag-override","bazel"],"backgroundTag":null,"analyzedSha":"e6e199d0601a244511b4cf18c8b2828aa73db1fd","analyzedAt":"2026-08-14T10:24:27.848Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}