{"record":{"id":"64868b7e5f27601c","repo":"Hmbown/CodeWhale","slug":"managed-external-credential-access-is-unsupported-64868b","errorCode":null,"errorMessage":"managed external credential access is unsupported for {}; no schema-safe preservation adapter is available","messagePattern":"managed external credential access is unsupported for (.+?); no schema-safe preservation adapter is available","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/config/src/external_credentials.rs","lineNumber":369,"sourceCode":"    /// Validate that this record is a current read-only consent for one exact\n    /// provider/source/path tuple without minting an I/O capability.\n    ///\n    /// This is intentionally side-effect free so inventory and picker surfaces\n    /// can acknowledge dormant consent without inspecting the external file.\n    pub fn validate_read_scope(\n        &self,\n        provider: ProviderKind,\n        source: ExternalCredentialSource,\n        resolved_path: &Path,\n    ) -> Result<()> {\n        if self.access == ExternalCredentialAccess::Disabled {\n            bail!(\n                \"external credential access is disabled for {}\",\n                provider.as_str()\n            );\n        }\n        if self.access == ExternalCredentialAccess::Managed {\n            bail!(\n                \"managed external credential access is unsupported for {}; no schema-safe preservation adapter is available\",\n                provider.as_str()\n            );\n        }\n        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {\n            bail!(\n                \"external credential consent for {} uses unsupported version {}; revoke and consent again\",\n                provider.as_str(),\n                self.consent_version\n            );\n        }\n        if self.provider != provider.as_str() {\n            bail!(\n                \"external credential consent is scoped to provider {:?}, not {}\",\n                self.provider,\n                provider.as_str()\n            );\n        }","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/config/src/external_credentials.rs#L351-L387","documentation":"Thrown by validate_read_scope when access mode is Managed: the library recognizes the mode but has no schema-safe adapter to preserve managed credentials, so it fails loudly instead of guessing. Unlike Disabled this is a capability gap — managed access is configured but simply not implemented for reads.","triggerScenarios":"read_grant for a provider whose ExternalCredentialsPolicy.access == ExternalCredentialAccess::Managed; config written by an enterprise tool that sets \"managed\" mode which the current binary cannot serve.","commonSituations":"Newer management tooling writing a `managed` access mode consumed by an older client build; copying a managed-machine config onto a dev box.","solutions":["Upgrade to a build that implements the managed preservation adapter, if available","Switch the provider's access mode from \"managed\" to a supported mode (e.g. \"read\" or \"disabled\")","Remove the managed setting and manage credentials through a mechanism the library supports (e.g. direct keychain)","File/report the gap so managed-mode support can be added"],"exampleFix":"// before (config.toml)\n[external_credentials.anthropic]\naccess = \"managed\"\n// after (config.toml)\n[external_credentials.anthropic]\naccess = \"read\"","handlingStrategy":"fallback","validationCode":"let policy = load_external_credentials_policy(provider)?;\nif policy.access == ExternalCredentialAccess::Managed {\n    // managed mode unsupported: choose another credential source up front\n}","typeGuard":null,"tryCatchPattern":"match read_grant(provider, source, &path) {\n    Err(e) if e.to_string().contains(\"unsupported\") => use_direct_credential_source(provider),\n    other => other?,\n}","preventionTips":["Avoid setting access = \"managed\" unless your build implements it","Version-match management tooling and the consuming binary","Keep credentials in sources the current build supports"],"tags":["config","credentials","unsupported","policy"],"backgroundTag":"unsupported-operation","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}