{"record":{"id":"67413afcab7bcf46","repo":"hyperledger/fabric","slug":"unmapped-policy-for-s","errorCode":null,"errorMessage":"Unmapped policy for %s","messagePattern":"Unmapped policy for (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/aclmgmt/defaultaclprovider.go","lineNumber":134,"sourceCode":"\treturn d\n}\n\nfunc (d *defaultACLProviderImpl) IsPtypePolicy(resName string) bool {\n\t_, ok := d.pResourcePolicyMap[resName]\n\treturn ok\n}\n\n// CheckACL provides default (v 1.0) behavior by mapping resources to their ACL for a channel.\nfunc (d *defaultACLProviderImpl) CheckACL(resName string, channelID string, idinfo any) error {\n\t// the default behavior is to use p type if defined and use channeless policy checks\n\tpolicy := d.pResourcePolicyMap[resName]\n\tif policy != \"\" {\n\t\tchannelID = \"\"\n\t} else {\n\t\tpolicy = d.cResourcePolicyMap[resName]\n\t\tif policy == \"\" {\n\t\t\taclLogger.Errorf(\"Unmapped policy for %s\", resName)\n\t\t\treturn fmt.Errorf(\"Unmapped policy for %s\", resName)\n\t\t}\n\t}\n\taclLogger.Debugw(\"Applying default access policy for resource\", \"channel\", channelID, \"policy\", policy, \"resource\", resName)\n\n\tswitch typedData := idinfo.(type) {\n\tcase *pb.SignedProposal:\n\t\treturn d.policyChecker.CheckPolicy(channelID, policy, typedData)\n\tcase *common.Envelope:\n\t\tsd, err := protoutil.EnvelopeAsSignedData(typedData)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn d.policyChecker.CheckPolicyBySignedData(channelID, policy, sd)\n\tcase *protoutil.SignedData:\n\t\treturn d.policyChecker.CheckPolicyBySignedData(channelID, policy, []*protoutil.SignedData{typedData})\n\tcase []*protoutil.SignedData:\n\t\treturn d.policyChecker.CheckPolicyBySignedData(channelID, policy, typedData)\n\tdefault:","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/aclmgmt/defaultaclprovider.go#L116-L152","documentation":"defaultACLProviderImpl.CheckACL maps a resource name to its default policy via cResourcePolicyMap (or the policy passed for resource-level). If no policy is registered for that channel resource, ACL evaluation cannot proceed and this error is returned. It means the resource name is not in Fabric's known default ACL resource list.","triggerScenarios":"Calling aclmgmt CheckACL(resName, channelID, idinfo) with a resource name absent from cResourcePolicyMap and no explicit policy override; typically from a custom chaincode/system handler using an invalid _lifecycle or lscc resource string.","commonSituations":"Typo in resource name (e.g. _lifecycle/DeployChaincode vs correct constant); Fabric version change where a resource was renamed/removed; custom code referencing resources only valid in newer releases.","solutions":["Use the exact resource constants from aclmgmt/resources (e.g._acl Resources area) rather than hand-typed strings.","Verify the resource exists in your Fabric version's defaultaclprovider cResourcePolicyMap.","If it's a config-driven ACL, add the resource mapping in channel config ACLs section.","Check the log line 'Unmapped policy for <res>' to see the offending name and fix it."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var knownResources = map[string]bool{\n    aclmgmt.Resources_Lifecycle_ChaincodeExists: true,\n    aclmgmt.Resources_Lifecycle_GetInstalledChaincode: true,\n    // ... populate from aclmgmt/resources for your version\n}\nif !knownResources[resName] {\n    return fmt.Errorf(\"resource %q has no default ACL mapping\", resName)\n}","typeGuard":null,"tryCatchPattern":"if err := aclProvider.CheckACL(resName, channelID, signedProp); err != nil {\n    if strings.HasPrefix(err.Error(), \"Unmapped policy\") {\n        log.Fatalf(\"resource %q unknown to this peer version\", resName)\n    }\n    return err\n}","preventionTips":["Reference resource names from the aclmgmt/resources generated constants, never strings typed by hand","Pin client/peer code to the same Fabric release","Review channel config ACLs overrides so every custom resource has a mapping"],"tags":["acl","policy","access-control"],"backgroundTag":"unmapped-acl-resource","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}