{"record":{"id":"b7567d413e105ad0","repo":"bazelbuild/bazel","slug":"flag-value-s-for-s-is-not-allowed-by-invocatio-b7567d","errorCode":null,"errorMessage":"Flag value '%s' for %s is not allowed by invocation policy and the policy does not specify a new value. %sed values are: %s","messagePattern":"Flag value '(.+?)' for (.+?) is not allowed by invocation policy and the policy does not specify a new value\\. (.+?)ed values are: (.+?)","errorType":"exception","errorClass":"OptionsParsingException","httpStatus":null,"severity":"error","filePath":"src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java","lineNumber":896,"sourceCode":"          if (newValue != null) {\n            logger.at(loglevel).log(\n                \"Overriding disallowed value '%s' for %s with value '%s' \"\n                    + \"specified by invocation policy. %sed values are: %s\",\n                valueDescription.getValue(), option, newValue, policyType, policyValues);\n            parser.clearValue(option);\n            parser.setOptionValueAtSpecificPriorityWithoutExpansion(origin, option, newValue);\n            invocationPolicyFlagListBuilder.add(\n                OptionAndRawValue.create(option.getOptionName(), newValue));\n          } else if (useDefault) {\n            applyUseDefaultOperation(\n                parser,\n                policyType + \"Values\",\n                option,\n                loglevel,\n                conversionContext,\n                invocationPolicyFlagListBuilder);\n          } else {\n            throw new OptionsParsingException(\n                String.format(\n                    \"Flag value '%s' for %s is not allowed by invocation policy and the \"\n                        + \"policy does not specify a new value. %sed values are: %s\",\n                    valueDescription.getValue(), option, policyType, policyValues));\n          }\n        }\n      }\n    }\n  }\n}\n","sourceCodeStart":878,"sourceCodeEnd":907,"githubUrl":"https://github.com/bazelbuild/bazel/blob/e6e199d0601a244511b4cf18c8b2828aa73db1fd/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java#L878-L907","documentation":"Thrown in checkUserValue (single-value branch) when the user-set value of a flag is not allowed by the allow_values/disallow_values policy and the policy provides neither a newValue nor use_default. Unlike error 38 this covers single-valued flags: the user's value is rejected and there is no policy fallback to substitute.","triggerScenarios":"Policy restricts a scalar flag (e.g. allowValues=['opt'] on compilation_mode); user passes a different value (dbg); policy has no newValue and no useDefault -> the else branch throws after the newValue/useDefault checks fail.","commonSituations":"Org allow-lists on flags like compilation_mode/strategy where users habitually pass other values, developer machines with personal .bazelrc values that violate newly rolled-out policy, CI matrix jobs iterating values only some of which are allowed.","solutions":["Change the command-line/.bazelrc value to one in the '%sed values' list printed by the error.","Policy owner: add newValue to auto-remap disallowed values, or widen the allowed set.","Check user-level ~/.bazelrc and project .bazelrc for the offending flag before assuming the command line is the source."],"exampleFix":"# before (policy allows only opt)\nbazel build --compilation_mode=dbg //...\n\n# after\nbazel build --compilation_mode=opt //...","handlingStrategy":"validation","validationCode":"// Wrapper-side: validate scalar flag value against the policy set before invoking\nSet<String> allowed = loadPolicyAllowedValues(flagName);\nString userVal = explicitValueFor(flagName, args, rcFiles);\nif (userVal != null && !allowed.contains(userVal)) {\n  throw new IllegalArgumentException(flagName + \" must be one of \" + allowed);\n}","typeGuard":null,"tryCatchPattern":"Catch OptionsParsingException; the message prints the offending value and the allowed list — surface both and point the user at every source of the flag (CLI, project .bazelrc, user ~/.bazelrc, aliases).","preventionTips":["Align personal .bazelrc values with the org allow-list","Policy owners: use newValue/use_default to remap rather than fail when feasible","Search all rc files (bazel's --announce_rc) when the command line looks clean"],"tags":["invocation-policy","allow-values","value-validation","bazel"],"backgroundTag":null,"analyzedSha":"e6e199d0601a244511b4cf18c8b2828aa73db1fd","analyzedAt":"2026-08-14T10:24:27.848Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}