{"record":{"id":"8d53f0f300530c5e","repo":"openai/codex","slug":"invalid-value-for-field-name-candidate-is","errorCode":null,"errorMessage":"invalid value for `{field_name}`: `{candidate}` is not in the allowed set {allowed} (set by {requirement_source})","messagePattern":"invalid value for `(.+?)`: `(.+?)` is not in the allowed set (.+?) \\(set by (.+?)\\)","errorType":"validation","errorClass":"ConstraintError","httpStatus":null,"severity":"error","filePath":"codex-rs/config/src/constraint.rs","lineNumber":9,"sourceCode":"use std::fmt;\nuse std::sync::Arc;\n\nuse crate::config_requirements::RequirementSource;\nuse thiserror::Error;\n\n#[derive(Debug, Error, PartialEq, Eq)]\npub enum ConstraintError {\n    #[error(\n        \"invalid value for `{field_name}`: `{candidate}` is not in the allowed set {allowed} (set by {requirement_source})\"\n    )]\n    InvalidValue {\n        field_name: &'static str,\n        candidate: String,\n        allowed: String,\n        requirement_source: RequirementSource,\n    },\n\n    #[error(\"To use model `{model}`, you need to use auto review.\")]\n    AutoReviewRequired { model: String },\n\n    #[error(\"field `{field_name}` cannot be empty\")]\n    EmptyField { field_name: String },\n\n    #[error(\"invalid rules in requirements (set by {requirement_source}): {reason}\")]\n    ExecPolicyParse {\n        requirement_source: RequirementSource,","sourceCodeStart":1,"sourceCodeEnd":27,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/config/src/constraint.rs#L1-L27","documentation":"ConstraintError::InvalidValue (codex-rs/config/src/constraint.rs:9) is produced by the Constrained<T> validators that config requirements install on fields. When a caller proposes a value for a constrained field, the validator rejects any candidate not in the allowed set; the error names the field, the allowed set, and the RequirementSource (the system/user/cloud/managed requirements file) that imposed it.","triggerScenarios":"Setting a requirements-constrained field (sandbox mode, approval policy, model, etc. via config.toml, CLI flag, or API set) to a value outside the set declared in a requirements layer; Constrained::new / can_set / set runs the validator and returns Err(InvalidValue).","commonSituations":"Enterprise requirements pin sandbox_mode to {workspace-write} while the user's config requests something else; an MDM profile narrows allowed models; user config conflicting with a system or managed requirements file after joining an org.","solutions":["Change the value to one of the entries printed in the allowed set in the message","Have the owner of the requirement source named in the error widen the allowed set if the value is legitimate","Remove or correct the user-level override that conflicts with the managed requirement"],"exampleFix":"# user config.toml (before)\nsandbox_mode = \"danger-full-access\"   # not in allowed set\n\n# (after)\nsandbox_mode = \"workspace-write\"","handlingStrategy":"validation","validationCode":"// Constrained exposes a pre-check: probe before committing the edit\nif let Err(e) = constrained.can_set(&candidate) {\n    // show the allowed set from the error instead of mutating config\n    return Err(e.into());\n}\nconstrained.set(candidate)?;","typeGuard":null,"tryCatchPattern":"match constrained.set(candidate) {\n    Err(ConstraintError::InvalidValue { field_name, allowed, requirement_source, .. }) => {\n        eprintln!(\"{field_name} must be one of {allowed} (per {requirement_source})\");\n    }\n    r => r?,\n}","preventionTips":["Read the effective requirements layer before offering values in config UIs so choices are pre-filtered to the allowed set","Call can_set before applying user edits so failures carry context","Log the requirement source on rejection so users know whom to contact"],"tags":["config","constraints","policy","enterprise","validation","rust"],"backgroundTag":"config-value-not-allowed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}