{"record":{"id":"6c17f52e5419b38b","repo":"zeroclaw-labs/zeroclaw","slug":"agents-agent-alias-risk-profile-is-empty","errorCode":null,"errorMessage":"agents.{agent_alias}.risk_profile is empty","messagePattern":"agents\\.(.+?)\\.risk_profile is empty","errorType":"console","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/security_status.rs","lineNumber":367,"sourceCode":"\nstruct ResolvedAgentContext<'a> {\n    profile_alias: String,\n    _risk_profile: &'a RiskProfileConfig,\n    agent_enabled: bool,\n    policy: SecurityPolicy,\n}\n\nfn resolve_agent_context<'a>(\n    config: &'a Config,\n    agent_alias: &str,\n) -> Result<ResolvedAgentContext<'a>> {\n    let agent_config = config\n        .agents\n        .get(agent_alias)\n        .with_context(|| format!(\"agents.{agent_alias} is not configured\"))?;\n    let profile_alias = agent_config.risk_profile.trim();\n    if profile_alias.is_empty() {\n        bail!(\"agents.{agent_alias}.risk_profile is empty\");\n    }\n    let risk_profile = config.risk_profiles.get(profile_alias).with_context(|| {\n        format!(\"agents.{agent_alias}.risk_profile names missing risk_profiles.{profile_alias}\")\n    })?;\n    let policy = SecurityPolicy::for_agent(config, agent_alias)?;\n\n    Ok(ResolvedAgentContext {\n        profile_alias: profile_alias.to_string(),\n        _risk_profile: risk_profile,\n        agent_enabled: agent_config.enabled,\n        policy,\n    })\n}\n\nfn sandbox_config_from_policy(policy: &SecurityPolicy) -> SandboxConfig {\n    SandboxConfig {\n        enabled: policy.sandbox_enabled,\n        backend: policy","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/security_status.rs#L349-L385","documentation":"Thrown while building the security status report: resolve_agent_context loads agents.<alias> from the ZeroClaw config and trims its risk_profile string. If that field is empty or whitespace-only, the agent cannot be mapped to a risk profile and report generation aborts before SecurityPolicy::for_agent runs. The check just after this one would reject a risk_profile that names a nonexistent risk_profiles.<name> entry, so an empty value is a distinct, earlier failure.","triggerScenarios":"Running the security status command (build_report path) for an agent whose [agents.<alias>] entry exists but has risk_profile = \"\", a risk_profile key absent so it defaults to empty, or a value made only of spaces/tabs.","commonSituations":"A new agent block copied from a template with the profile left blank; risk_profile dropped during a config migration or hand-edit; TOML indentation putting risk_profile under the wrong table so the agent entry sees the empty default.","solutions":["Open the active config at [agents.<alias>] and set risk_profile to an existing key, e.g. risk_profile = \"standard\"","Confirm a matching [risk_profiles.<name>] table exists — otherwise the next check fails with 'names missing risk_profiles.<name>'","Re-run the security status command and confirm the report renders","If unsure which profiles exist, list the top-level risk_profiles map in the config before choosing"],"exampleFix":"# before\n[agents.helper]\nenabled = true\nrisk_profile = \"\"\n\n# after\n[agents.helper]\nenabled = true\nrisk_profile = \"standard\"\n\n[risk_profiles.standard]\nsandbox_enabled = true","handlingStrategy":"validation","validationCode":"// Rust, before building the security report\nfn agent_risk_profile_ready(config: &zeroclaw_config::config::Config, alias: &str) -> bool {\n    config.agents.get(alias).is_some_and(|a| {\n        let profile = a.risk_profile.trim();\n        !profile.is_empty() && config.risk_profiles.get(profile).is_some()\n    })\n}\n\nif !agent_risk_profile_ready(&config, \"helper\") {\n    eprintln!(\"agent 'helper' needs a non-empty risk_profile that exists under [risk_profiles]\");\n}","typeGuard":null,"tryCatchPattern":"match build_report(&config) {\n    Err(e) if e.to_string().contains(\"risk_profile is empty\") => { /* fill the field, do not retry unchanged */ }\n    Err(e) if e.to_string().contains(\"names missing risk_profiles\") => { /* add the profile entry */ }\n    other => other,\n}","preventionTips":["Treat risk_profile as required in every [agents.*] block from creation","Add a config lint that walks config.agents and asserts each trimmed risk_profile resolves into config.risk_profiles","Run the security status command once in CI after config changes to catch blanked fields early"],"tags":["config","security","agent","risk-profile","security-status"],"backgroundTag":"missing-config-field","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}