{"record":{"id":"8be0d9d2fc2e389c","repo":"hashicorp/nomad","slug":"invalid-policy-s","errorCode":null,"errorMessage":"Invalid policy: %s","messagePattern":"Invalid policy: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":565,"sourceCode":"// constants PolicyParseStrict and PolicyParseLenient can be used to make the\n// intent clear at the call site.\nfunc Parse(rules string, strict bool) (*Policy, error) {\n\t// Decode the rules\n\tp := &Policy{Raw: rules}\n\tif rules == \"\" {\n\t\t// Hot path for empty rules\n\t\treturn p, nil\n\t}\n\n\t// Attempt to parse\n\tif err := hclDecode(p, rules); err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to parse ACL Policy: %v\", err)\n\t}\n\n\t// At least one valid policy must be specified, we don't want to store only\n\t// raw data\n\tif p.IsEmpty() {\n\t\treturn nil, fmt.Errorf(\"Invalid policy: %s\", p.Raw)\n\t}\n\n\t// Validate the policy\n\tfor _, ns := range p.Namespaces {\n\t\tif !validNamespace.MatchString(ns.Name) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace name: %#v\", ns)\n\t\t}\n\t\tif ns.Policy != \"\" && !isPolicyValid(ns.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace policy: %#v\", ns)\n\t\t}\n\t\tfor _, cap := range ns.Capabilities {\n\t\t\tif !isNamespaceCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid namespace capability '%s': %#v\", cap, ns)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities","sourceCodeStart":547,"sourceCodeEnd":583,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L547-L583","documentation":"acl/policy.go:565 (Parse) returns 'Invalid policy: %s' (with the raw policy text) when the policy decodes as valid HCL but parses to an empty policy (p.IsEmpty()) — i.e., it contains no actual rules. Nomad refuses to store rule-less policies because they would be meaningless placeholders.","triggerScenarios":"Applying an ACL policy whose rules contain only comments, whitespace, or empty stanzas; a template/variable interpolation that evaluated to nothing; passing an empty or comments-only rules file to nomad acl policy apply.","commonSituations":"CI pipelines templating policies where variables were empty, yielding comments-only output; truncation of the rules file upstream; accidentally applying an example file that documents policy format only in comments.","solutions":["Include at least one real rule stanza (namespace/node/service/host_volume/variables etc.) in the policy","Fix the templating pipeline that produced an empty/whitespace-only rules document","Verify with nomad acl policy apply after ensuring the file has actual content"],"exampleFix":"// before\n# only comments in rules.hcl\n# namespace \"default\" { ... }\n// after\nnamespace \"default\" {\n  policy = \"read\"\n}","handlingStrategy":"validation","validationCode":"// ensure the policy has at least one rule before submitting\nif strings.TrimSpace(stripComments(rules)) == \"\" { return errors.New(\"policy has no rules\") }","typeGuard":null,"tryCatchPattern":"if _, err := acl.ParsePolicy(rules); err != nil {\n    if strings.HasPrefix(err.Error(), \"Invalid policy:\") {\n        return fmt.Errorf(\"rules file rendered empty — check templates: %w\", err)\n    }\n    return err\n}","preventionTips":["Never ship comment-only or empty policy files","Assert templated policies contain at least one stanza in CI","Inspect rendered policy artifacts when generating rules dynamically"],"tags":["acl","policy","validation"],"backgroundTag":"empty-policy-rule","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}