{"record":{"id":"cc44c76fb042203e","repo":"dapr/dapr","slug":"failed-to-load-workflow-access-policies-w","errorCode":null,"errorMessage":"failed to load workflow access policies: %w","messagePattern":"failed to load workflow access policies: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/runtime/runtime.go","lineNumber":804,"sourceCode":"\t// Create and start internal and external gRPC servers\n\ta.daprGRPCAPI = grpc.NewAPI(grpc.APIOpts{\n\t\tUniversal:              a.daprUniversal,\n\t\tLogger:                 logger.NewLogger(\"dapr.grpc.api\"),\n\t\tChannels:               a.channels,\n\t\tPubSubAdapter:          a.pubsubAdapter,\n\t\tPubSubAdapterStreamer:  a.pubsubAdapterStreamer,\n\t\tOutbox:                 a.outbox,\n\t\tDirectMessaging:        a.directMessaging,\n\t\tSendToOutputBindingFn:  a.processor.Binding().SendToOutputBinding,\n\t\tTracingSpec:            a.globalConfig.GetTracingSpec(),\n\t\tAccessControlList:      a.accessControlList,\n\t\tProcessor:              a.processor,\n\t\tWorkflowAccessPolicies: a.workflowAccessPolicies,\n\t})\n\n\t// Load and apply workflow access policies before starting servers.\n\tif err = a.loadWorkflowAccessPolicies(ctx); err != nil {\n\t\treturn fmt.Errorf(\"failed to load workflow access policies: %w\", err)\n\t}\n\n\ta.reloader.SetPolicyRecompiler(reconciler.WorkflowAccessPolicyOptions{\n\t\tAppID:      a.runtimeConfig.id,\n\t\tLoader:     a.reloader.Loader(),\n\t\tCompStore:  a.compStore,\n\t\tRecompiler: a.workflowAccessPolicies.Store,\n\t\tHealthz:    a.runtimeConfig.healthz,\n\t})\n\n\tif err = a.runnerCloser.AddCloser(a.daprGRPCAPI); err != nil {\n\t\treturn err\n\t}\n\n\terr = a.startGRPCAPIServer(ctx, a.daprGRPCAPI, a.runtimeConfig.apiGRPCPort)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to start API gRPC server: %w\", err)\n\t}","sourceCodeStart":786,"sourceCodeEnd":822,"githubUrl":"https://github.com/dapr/dapr/blob/74ad41702745709bb15fe2114ff693b8c59bc3cc/pkg/runtime/runtime.go#L786-L822","documentation":"Emitted from DaprRuntime.Run when loadWorkflowAccessPolicies fails during sidecar startup. WorkflowAccessPolicy resources are read from disk (standalone mode, resources path) or from the Dapr operator API (Kubernetes mode); individual policies that fail semantic validation are skipped with only a warning, so this error means the loader itself broke: unreadable/unparseable resource files or a failing operator client. The sidecar aborts startup.","triggerScenarios":"Running daprd with a resources directory containing a WorkflowAccessPolicy YAML file that is unreadable (permissions) or unparseable (invalid YAML/JSON at the file level); in Kubernetes, the operator client failing to list WorkflowAccessPolicy CRs (API error, RBAC, operator unreachable).","commonSituations":"A typo or bad indentation in a WorkflowAccessPolicy manifest dropped into the components/resources path; wrong --resources-path pointing at a non-directory; stale CRD version in the cluster so the operator list call fails; custom embedders setting an invalid mode producing a nil loader edge case.","solutions":["Read the wrapped error (%w) to see whether it is a file/parse error (standalone) or a Kubernetes API error","In standalone: verify --resources-path exists and every file in it parses as valid YAML/JSON (kubectl apply --dry-run=client or yamllint)","In Kubernetes: verify the operator pod is healthy and the daprd service account can list workflowaccesspolicies (check CRD installed and RBAC)","Temporarily remove WorkflowAccessPolicy resources to confirm the rest of startup succeeds, then re-add them one by one"],"exampleFix":"# before: malformed resource file\napiVersion: dapr.io/v1alpha1\nkind: WorkflowAccessPolicy\nmetadata: { name: wf-policy\n  # missing closing brace / bad indent\n\n# after: validate with\nkubectl apply --dry-run=client -f resources.yaml","handlingStrategy":"validation","validationCode":"// Before starting daprd, ensure every resource file parses.\nimport (\n  \"os\"\n  \"path/filepath\"\n  \"gopkg.in/yaml.v3\"\n)\nfunc lintResources(dir string) error {\n  entries, err := os.ReadDir(dir)\n  if err != nil { return err }\n  for _, e := range entries {\n    if e.IsDir() { continue }\n    b, err := os.ReadFile(filepath.Join(dir, e.Name()))\n    if err != nil { return err }\n    var v any\n    if err := yaml.Unmarshal(b, &v); err != nil {\n      return fmt.Errorf(\"%s: %w\", e.Name(), err)\n    }\n  }\n  return nil\n}","typeGuard":"func isWorkflowAccessPolicyLoadErr(err error) bool {\n    return err != nil && strings.HasPrefix(err.Error(), \"failed to load workflow access policies:\")\n}","tryCatchPattern":null,"preventionTips":["Lint the resources directory in CI with yamllint or kubectl --dry-run=client","Keep WorkflowAccessPolicy manifests in version control and apply them via pipeline, not hand edits","In Kubernetes, pin the Dapr CRD version matching the sidecar release"],"tags":["dapr","startup","workflow","configuration","acl"],"backgroundTag":null,"analyzedSha":"74ad41702745709bb15fe2114ff693b8c59bc3cc","analyzedAt":"2026-08-16T04:22:26.543Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}