{"record":{"id":"c794aa9166ae92e5","repo":"hashicorp/nomad","slug":"invalid-agent-policy-v","errorCode":null,"errorMessage":"Invalid agent policy: %#v","messagePattern":"Invalid agent policy: %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":679,"sourceCode":"\n\t\t// Remove the host-volume name from the extra key list.\n\t\tp.removeExtraKey(hv.Name)\n\t}\n\n\t// Now that we have processed all known keys, return an error if the\n\t// operator wrote a policy with unknown keys if we are being strict. While\n\t// these do not grant any extra privileges, it can be misleaing to allow\n\t// these and cause problems later if we add new capabilities that collide\n\t// with the unknown keys.\n\tif len(p.ExtraKeysHCL) > 0 && strict {\n\t\treturn nil, fmt.Errorf(\"Invalid or duplicate policy keys: %v\",\n\t\t\tstrings.Join(p.ExtraKeysHCL, \", \"))\n\t}\n\n\tp.ExtraKeysHCL = nil\n\n\tif p.Agent != nil && !isPolicyValid(p.Agent.Policy) {\n\t\treturn nil, fmt.Errorf(\"Invalid agent policy: %#v\", p.Agent)\n\t}\n\n\tif p.Node != nil && !isPolicyValid(p.Node.Policy) {\n\t\treturn nil, fmt.Errorf(\"Invalid node policy: %#v\", p.Node)\n\t}\n\n\tif p.Operator != nil {\n\t\tif p.Operator.Policy != \"\" && !isPolicyValid(p.Operator.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid operator policy: %#v\", p.Operator)\n\t\t}\n\t\tfor _, cap := range p.Operator.Capabilities {\n\t\t\tif !isOperatorCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid operator capability '%s'\", cap)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities","sourceCodeStart":661,"sourceCodeEnd":697,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L661-L697","documentation":"acl.Parse (acl/policy.go:679) validates the top-level agent block's Policy string with isPolicyValid, which only accepts deny, read, write, scale. An agent block with any other policy value (including 'list', which is valid for plugins but not agent) fails parsing and rejects the whole policy.","triggerScenarios":"acl.Parse on a policy containing agent { policy = \"<invalid>\" } where the value is not exactly \"deny\", \"read\", \"write\", or \"scale\" — e.g. 'list', 'Read', 'monitor', or an empty-but-set string from a template.","commonSituations":"Copying the plugin block's allowed 'list' policy into the agent block; capitalization mistakes; automated policy generation substituting a capability name where a policy shorthand is expected.","solutions":["Set the agent block's policy to exactly one of: deny, read, write, scale (lowercase).","Use capabilities for fine-grained agent permissions instead of the shorthand if the needed level is not expressible.","Inspect the %#v struct in the error to confirm it is the agent block and see the current Policy value."],"exampleFix":"// before\nagent {\n  policy = \"list\"\n}\n// after\nagent {\n  policy = \"read\"\n}","handlingStrategy":"validation","validationCode":"if policy.Agent != nil && policy.Agent.Policy != \"\" &&\n    !map[string]bool{\"deny\": true, \"read\": true, \"write\": true, \"scale\": true}[policy.Agent.Policy] {\n    return fmt.Errorf(\"agent policy %q must be deny|read|write|scale\", policy.Agent.Policy)\n}","typeGuard":"func isPolicyValid(policy string) bool {\n    switch policy {\n    case \"deny\", \"read\", \"write\", \"scale\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"_, err := acl.Parse(rules, acl.PolicyParseStrict)\nif err != nil {\n    if strings.Contains(err.Error(), \"Invalid agent policy\") {\n        // correct the agent block's policy to a valid shorthand\n    }\n    return err\n}","preventionTips":["Use only deny, read, write, scale in the agent block's policy field","Do not copy plugin- or namespace-specific policy values into the agent block","Validate generated policies with the same switch used by isPolicyValid before submitting"],"tags":["nomad","acl","policy-validation","agent"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}