{"record":{"id":"9888e4ed9c342362","repo":"hyperledger/fabric","slug":"chaincode-instantiation-policy-violated-error-s","errorCode":null,"errorMessage":"chaincode instantiation policy violated, error %s","messagePattern":"chaincode instantiation policy violated, error (.+?)","errorType":"validation","errorClass":"VSCCEndorsementPolicyError","httpStatus":null,"severity":"error","filePath":"core/handlers/validation/builtin/v12/validation_logic.go","lineNumber":197,"sourceCode":"}\n\n// checkInstantiationPolicy evaluates an instantiation policy against a signed proposal.\nfunc (vscc *Validator) checkInstantiationPolicy(chainName string, env *common.Envelope, instantiationPolicy []byte, payl *common.Payload) commonerrors.TxValidationError {\n\t// get the signature header\n\tshdr, err := protoutil.UnmarshalSignatureHeader(payl.Header.SignatureHeader)\n\tif err != nil {\n\t\treturn policyErr(err)\n\t}\n\n\t// construct signed data we can evaluate the instantiation policy against\n\tsd := []*protoutil.SignedData{{\n\t\tData:      env.Payload,\n\t\tIdentity:  shdr.Creator,\n\t\tSignature: env.Signature,\n\t}}\n\terr = vscc.policyEvaluator.Evaluate(instantiationPolicy, sd)\n\tif err != nil {\n\t\treturn policyErr(fmt.Errorf(\"chaincode instantiation policy violated, error %s\", err))\n\t}\n\treturn nil\n}\n\nfunc validateNewCollectionConfigs(newCollectionConfigs []*pb.CollectionConfig) error {\n\tnewCollectionsMap := make(map[string]bool, len(newCollectionConfigs))\n\t// Process each collection config from a set of collection configs\n\tfor _, newCollectionConfig := range newCollectionConfigs {\n\n\t\tnewCollection := newCollectionConfig.GetStaticCollectionConfig()\n\t\tif newCollection == nil {\n\t\t\treturn errors.New(\"unknown collection configuration type\")\n\t\t}\n\n\t\t// Ensure that there are no duplicate collection names\n\t\tcollectionName := newCollection.GetName()\n\n\t\tif err := validateCollectionName(collectionName); err != nil {","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/validation/builtin/v12/validation_logic.go#L179-L215","documentation":"For lscc invocations, VSCC additionally evaluates the chaincode's instantiation policy against the transaction creator's signed data. If the creator's signature set does not satisfy that policy, the transaction is rejected with this message. It prevents unauthorized users from deploying or upgrading chaincode on a channel.","triggerScenarios":"Deploying or upgrading (lscc deploy/upgrade) a chaincode whose creator is not a member/admin per the stored instantiation policy; invoking ValidateLSCCInvocation with a transaction signed by an identity the instantiation policy rejects.","commonSituations":"A user from an organization outside the instantiation policy attempting to instantiate chaincode; instantiation policy left at its default (e.g. requiring a specific org admin) while deployment is attempted by a regular member; certificate/MSP changes that alter the creator identity's role.","solutions":["Deploy/instantiate the chaincode with an identity that satisfies the instantiation policy (typically an admin of the required org)","Set a correct instantiation policy at chaincode install/deploy time matching who should be allowed to deploy","Verify the creator's MSP membership/role (admin vs member) is as expected in the channel config"],"exampleFix":"// before\n// deploy signed by a regular member of Org1, policy requires Admin\nsigner = orgMemberIdentity\n// after\nsigner = orgAdminIdentity // satisfies chaincode instantiation policy","handlingStrategy":"validation","validationCode":"// verify deployer identity is permitted before instantiating chaincode\nif !isChannelAdminOrAllowedByInstantiationPolicy(creatorIdentity) {\n    return errors.New(\"creator does not satisfy chaincode instantiation policy\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deploy chaincode with an identity matching the instantiation policy","Set explicit instantiation policies at install time that reflect your org workflow","Track MSP role (admin vs member) changes that affect deployment rights"],"tags":["go","instantiation-policy","lscc","authorization"],"backgroundTag":"policy-violation","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}