{"record":{"id":"aaf0eb40326af3cd","repo":"hashicorp/nomad","slug":"invalid-namespace-capability-s-v","errorCode":null,"errorMessage":"Invalid namespace capability '%s': %#v","messagePattern":"Invalid namespace capability '(.+?)': %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":578,"sourceCode":"\t}\n\n\t// At least one valid policy must be specified, we don't want to store only\n\t// raw data\n\tif p.IsEmpty() {\n\t\treturn nil, fmt.Errorf(\"Invalid policy: %s\", p.Raw)\n\t}\n\n\t// Validate the policy\n\tfor _, ns := range p.Namespaces {\n\t\tif !validNamespace.MatchString(ns.Name) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace name: %#v\", ns)\n\t\t}\n\t\tif ns.Policy != \"\" && !isPolicyValid(ns.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid namespace policy: %#v\", ns)\n\t\t}\n\t\tfor _, cap := range ns.Capabilities {\n\t\t\tif !isNamespaceCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid namespace capability '%s': %#v\", cap, ns)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif ns.Policy != \"\" {\n\t\t\textraCap := expandNamespacePolicy(ns.Policy)\n\t\t\tns.Capabilities = append(ns.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Expand implicit capabilities\n\t\texpandNamespaceCapabilities(ns)\n\n\t\tif ns.Variables != nil {\n\t\t\tif len(ns.Variables.Paths) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid variable policy: no variable paths in namespace %s\", ns.Name)\n\t\t\t}\n\t\t\tfor _, pathPolicy := range ns.Variables.Paths {","sourceCodeStart":560,"sourceCodeEnd":596,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L560-L596","documentation":"Returned by acl.Parse in acl/policy.go:578 when a namespace stanza lists a capability not accepted by isNamespaceCapabilityValid (acl/policy.go:281). Valid capabilities include list-jobs, read-job, submit-job, dispatch-job, read-logs, alloc-exec, csi-* volume capabilities, host-volume-* capabilities, scaling/deployment capabilities, sentinel-override and submit-recommendation (enterprise). Any other string is rejected.","triggerScenarios":"Calling acl.Parse with namespace { capabilities = [...] } containing an unknown/misspelled capability string, a node-pool or variables capability misplaced in a namespace stanza, or an operator capability like 'snapshot-save' inside capabilities.","commonSituations":"Typos ('submit-jobs', 'read-fs' vs 'read-fs' correct form is 'read-fs'? actually list-fs variants) — most often hyphen/singular-plural mistakes; copying capabilities between stanza types (node_pool vs namespace vs variables); using capabilities from a newer Nomad release against an older vendored library version that lacks them.","solutions":["Replace the capability with one from Nomad's documented namespace capability list (exact kebab-case spelling)","Move non-namespace capabilities (e.g. node-pool or variables capabilities) into their own stanzas","Upgrade the nomad dependency if the capability exists in a newer Nomad release","Use short-hand policy = \"read\"/\"write\" instead of hand-listed capabilities when possible"],"exampleFix":"// before\nnamespace \"prod\" {\n  capabilities = [\"read-jobs\", \"submit-job\"]\n}\n// after\nnamespace \"prod\" {\n  capabilities = [\"read-job\", \"submit-job\"]\n}","handlingStrategy":"validation","validationCode":"var validNsCaps = map[string]bool{\n  \"deny\":true,\"list-jobs\":true,\"parse-job\":true,\"read-job\":true,\"submit-job\":true,\n  \"dispatch-job\":true,\"read-logs\":true,\"read-fs\":true,\"alloc-exec\":true,\"alloc-node-exec\":true,\n  \"alloc-lifecycle\":true,\"csi-register-plugin\":true,\"csi-write-volume\":true,\"csi-read-volume\":true,\n  \"csi-list-volume\":true,\"csi-mount-volume\":true,\"host-volume-create\":true,\"host-volume-register\":true,\n  \"host-volume-read\":true,\"host-volume-write\":true,\"host-volume-delete\":true,\n  \"list-scaling-policies\":true,\"read-scaling-policy\":true,\"read-job-scaling\":true,\"scale-job\":true,\n  \"register-job\":true,\"revert-job\":true,\"deregister-job\":true,\"purge-job\":true,\"evaluate-job\":true,\n  \"plan-job\":true,\"tag-job-version\":true,\"stable-job\":true,\"fail-deployment\":true,\"pause-deployment\":true,\n  \"promote-deployment\":true,\"unblock-deployment\":true,\"cancel-deployment\":true,\"set-alloc-health\":true,\n  \"gc-alloc\":true,\"pause-alloc\":true,\"force-periodic-job\":true,\"delete-service-registration\":true,\n  \"sentinel-override\":true,\"submit-recommendation\":true,\n}\nfor _, ns := range policy.Namespaces {\n  for _, c := range ns.Capabilities {\n    if !validNsCaps[c] { return fmt.Errorf(\"namespace %s: bad capability %q\", ns.Name, c) }\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy capability names only from the official Nomad namespace capability documentation","Never share capability lists across namespace/node_pool/variables stanzas","Keep the nomad dependency current so new capabilities parse on older agents' libraries"],"tags":["nomad","acl","policy-validation","capabilities"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}