{"record":{"id":"6b709c8da98a8c2b","repo":"grpc/grpc-go","slug":"allow-rules-is-not-present","errorCode":null,"errorMessage":"\"allow_rules\" is not present","messagePattern":"\"allow_rules\" is not present","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"authz/rbac_translator.go","lineNumber":373,"sourceCode":"\t}\n}\n\n// translatePolicy translates SDK authorization policy in JSON format to two\n// Envoy RBAC polices (deny followed by allow policy) or only one Envoy RBAC\n// allow policy. Also returns the overall policy name. If the input policy\n// cannot be parsed or is invalid, an error will be returned.\nfunc translatePolicy(policyStr string) ([]*v3rbacpb.RBAC, string, error) {\n\tpolicy := &authorizationPolicy{}\n\td := json.NewDecoder(bytes.NewReader([]byte(policyStr)))\n\td.DisallowUnknownFields()\n\tif err := d.Decode(policy); err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"failed to unmarshal policy: %v\", err)\n\t}\n\tif policy.Name == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(`\"name\" is not present`)\n\t}\n\tif len(policy.AllowRules) == 0 {\n\t\treturn nil, \"\", fmt.Errorf(`\"allow_rules\" is not present`)\n\t}\n\tallowLogger, denyLogger, err := policy.AuditLoggingOptions.toProtos()\n\tif err != nil {\n\t\treturn nil, \"\", err\n\t}\n\trbacs := make([]*v3rbacpb.RBAC, 0, 2)\n\tif len(policy.DenyRules) > 0 {\n\t\tdenyPolicies, err := parseRules(policy.DenyRules, policy.Name)\n\t\tif err != nil {\n\t\t\treturn nil, \"\", fmt.Errorf(`\"deny_rules\" %v`, err)\n\t\t}\n\t\tdenyRBAC := &v3rbacpb.RBAC{\n\t\t\tAction:              v3rbacpb.RBAC_DENY,\n\t\t\tPolicies:            denyPolicies,\n\t\t\tAuditLoggingOptions: denyLogger,\n\t\t}\n\t\trbacs = append(rbacs, denyRBAC)\n\t}","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/authz/rbac_translator.go#L355-L391","documentation":"Raised by translatePolicy when the policy has a name but allow_rules is absent or empty. The gRPC SDK authorization model treats allow_rules as mandatory (an empty allow list would deny everything by default, which is treated as a misconfiguration); parseRules is only called when len(AllowRules) > 0, otherwise this error fires.","triggerScenarios":"The policy JSON omits allow_rules, sets it to [], or only supplies deny_rules. translatePolicy checks `len(policy.AllowRules) == 0` and returns this error.","commonSituations":"Authoring a deny-only policy and forgetting that the SDK still requires a non-empty allow_rules; a policy templating bug that drops allow_rules when it's the only meaningful block; misreading the schema where deny_rules is optional but allow_rules is required.","solutions":["Add at least one allow_rules entry (e.g. a permissive catch-all rule if you want deny_rules to be the effective gate).","If you want 'allow all then deny some', add an allow rule with a wildcard request (paths [\"/*\"]).","Re-read the SDK schema: allow_rules is required, deny_rules is optional.","Lint the policy for a non-empty allow_rules array before deploy."],"exampleFix":"// before:\n{ \"name\": \"p\", \"deny_rules\": [ { \"name\": \"d\", \"source\": { \"principals\": [\"bad\"] } } ] }   // no allow_rules\n\n// after:\n{\n  \"name\": \"p\",\n  \"allow_rules\": [ { \"name\": \"allow-all\", \"request\": { \"paths\": [\"/*\"] } } ],\n  \"deny_rules\": [ { \"name\": \"d\", \"source\": { \"principals\": [\"bad\"] } } ]\n}","handlingStrategy":"validation","validationCode":"func validateAllowRulesPresent(policyStr string) error {\n    var p struct {\n        AllowRules []json.RawMessage `json:\"allow_rules\"`\n    }\n    if err := json.Unmarshal([]byte(policyStr), &p); err != nil { return err }\n    if len(p.AllowRules) == 0 {\n        return fmt.Errorf(`\"allow_rules\" is not present`) // mirrors SDK\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember allow_rules is mandatory; deny_rules is optional.","Add a wildcard allow rule if deny-only semantics are intended.","Lint for non-empty allow_rules in CI.","Document the allow-first model for policy authors."],"tags":["authz","rbac","authorization-policy","config","validation"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}