{"record":{"id":"a7d63b711703bc61","repo":"hashicorp/nomad","slug":"invalid-namespace-policy-v","errorCode":null,"errorMessage":"Invalid namespace policy: %#v","messagePattern":"Invalid namespace policy: %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":574,"sourceCode":"\n\t// Attempt to parse\n\tif err := hclDecode(p, rules); err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to parse ACL Policy: %v\", err)\n\t}\n\n\t// At least one valid policy must be specified, we don't want to store only\n\t// raw data\n\tif p.IsEmpty() {\n\t\treturn nil, fmt.Errorf(\"Invalid policy: %s\", p.Raw)\n\t}\n\n\t// Validate the policy\n\tfor _, ns := range p.Namespaces {\n\t\tif !validNamespace.MatchString(ns.Name) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace name: %#v\", ns)\n\t\t}\n\t\tif ns.Policy != \"\" && !isPolicyValid(ns.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace policy: %#v\", ns)\n\t\t}\n\t\tfor _, cap := range ns.Capabilities {\n\t\t\tif !isNamespaceCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid namespace capability '%s': %#v\", cap, ns)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif ns.Policy != \"\" {\n\t\t\textraCap := expandNamespacePolicy(ns.Policy)\n\t\t\tns.Capabilities = append(ns.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Expand implicit capabilities\n\t\texpandNamespaceCapabilities(ns)\n\n\t\tif ns.Variables != nil {","sourceCodeStart":556,"sourceCodeEnd":592,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L556-L592","documentation":"Returned by acl.Parse in acl/policy.go:574 when a namespace stanza's policy shorthand is non-empty but not one of the accepted values deny, read, write, or scale (isPolicyValid switch). Nomad namespaces accept either the short-hand policy string or fine-grained capabilities, never an arbitrary policy word. The message prints the whole NamespacePolicy struct via %#v.","triggerScenarios":"Calling acl.Parse with a policy where namespace { policy = \"...\" } is set to a value outside {deny, read, write, scale} — e.g. \"list\", \"rw\", \"read-write\", \"admin\", or a case-mismatched variant like \"READ\".","commonSituations":"Copy-pasting Consul-style or Vault-style policy words (read/list/root) into Nomad namespace stanzas; typos such as 'writ'; assuming uppercase or 'scale-old' values from older Nomad versions where scale did not exist; generators emitting lowercase-normalized tokens incorrectly.","solutions":["Change the namespace policy to one of: deny, read, write, scale (exact lowercase)","If the intended grant is fine-grained, drop 'policy' and list explicit 'capabilities' instead","Check the Nomad version: 'scale' is only valid in newer releases; remove it for older agents","Pre-validate with isPolicyValid-equivalent logic or acl.Parse in a unit test"],"exampleFix":"// before\nnamespace \"prod\" {\n  policy = \"read-write\"\n}\n// after\nnamespace \"prod\" {\n  policy = \"write\"\n}","handlingStrategy":"validation","validationCode":"var validNsPolicies = map[string]bool{\"deny\": true, \"read\": true, \"write\": true, \"scale\": true}\nfor _, ns := range policy.Namespaces {\n    if ns.Policy != \"\" && !validNsPolicies[ns.Policy] {\n        return fmt.Errorf(\"namespace %s: policy %q not in deny|read|write|scale\", ns.Name, ns.Policy)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use exact lowercase deny/read/write/scale as namespace policy shorthand","Prefer explicit capabilities lists to avoid shorthand keyword drift across Nomad versions","Add a lint rule or schema (e.g. JSON schema/CUE) restricting policy values to the enum"],"tags":["nomad","acl","policy-validation","namespace"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}