{"record":{"id":"75a6f1d558eee639","repo":"hashicorp/nomad","slug":"invalid-variable-policy-no-variable-paths-in-name","errorCode":null,"errorMessage":"Invalid variable policy: no variable paths in namespace %s","messagePattern":"Invalid variable policy: no variable paths in namespace (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":594,"sourceCode":"\t\tfor _, cap := range ns.Capabilities {\n\t\t\tif !isNamespaceCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid namespace capability '%s': %#v\", cap, ns)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif ns.Policy != \"\" {\n\t\t\textraCap := expandNamespacePolicy(ns.Policy)\n\t\t\tns.Capabilities = append(ns.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Expand implicit capabilities\n\t\texpandNamespaceCapabilities(ns)\n\n\t\tif ns.Variables != nil {\n\t\t\tif len(ns.Variables.Paths) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid variable policy: no variable paths in namespace %s\", ns.Name)\n\t\t\t}\n\t\t\tfor _, pathPolicy := range ns.Variables.Paths {\n\t\t\t\tif pathPolicy.PathSpec == \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"Invalid missing variable path in namespace %s\", ns.Name)\n\t\t\t\t}\n\t\t\t\tif strings.HasPrefix(pathPolicy.PathSpec, \"/\") {\n\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\"Invalid variable path %q in namespace %s: cannot start with a leading '/'`\",\n\t\t\t\t\t\tpathPolicy.PathSpec, ns.Name)\n\t\t\t\t}\n\t\t\t\tfor _, cap := range pathPolicy.Capabilities {\n\t\t\t\t\tif !isPathCapabilityValid(cap) {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\t\"Invalid variable capability '%s' in namespace %s\", cap, ns.Name)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tpathPolicy.Capabilities = expandVariablesCapabilities(pathPolicy.Capabilities)\n","sourceCodeStart":576,"sourceCodeEnd":612,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L576-L612","documentation":"Returned by acl.Parse in acl/policy.go:594 when a namespace stanza contains a variables block whose Paths list is empty. A variables stanza must define at least one path block to be meaningful, so the parser rejects an empty paths array rather than silently granting nothing.","triggerScenarios":"Calling acl.Parse with namespace { variables { paths = [] } } or an HCL variables stanza with no path blocks inside, in any namespace of the policy.","commonSituations":"Templating tools emitting an empty variables section when no variable grants were configured; hand-removing all path blocks but leaving the variables stanza; JSON policy conversion dropping path entries due to schema mismatch.","solutions":["Add at least one path block inside the variables stanza, e.g. path \"secret/app\" { capabilities = [\"read\"] }","Remove the entire variables stanza if no variable access is intended","Fix the template/generator so it omits variables when paths are absent"],"exampleFix":"// before\nnamespace \"prod\" {\n  variables {\n    paths = []\n  }\n}\n// after\nnamespace \"prod\" {\n  variables {\n    path \"secret/app\" {\n      capabilities = [\"read\", \"list\"]\n    }\n  }\n}","handlingStrategy":"validation","validationCode":"for _, ns := range policy.Namespaces {\n    if ns.Variables != nil && len(ns.Variables.Paths) == 0 {\n        return fmt.Errorf(\"namespace %s: variables stanza needs at least one path\", ns.Name)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit the variables stanza entirely when no variable grants are configured","Make templating tools drop empty variables blocks instead of emitting them","Assert in CI that every variables block contains >= 1 path"],"tags":["nomad","acl","variables","policy-validation"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}