{"record":{"id":"ce66fcd6f394ebc5","repo":"grpc/grpc-java","slug":"allow-rules-is-absent","errorCode":null,"errorMessage":"\"allow_rules\" is absent","messagePattern":"\"allow_rules\" is absent","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java","lineNumber":190,"sourceCode":"    }\n    @SuppressWarnings(\"unchecked\")\n    Map<String, ?> json = (Map<String, ?>)jsonObject;\n    String name = JsonUtil.getString(json, \"name\");\n    if (name == null || name.isEmpty()) {\n      throw new IllegalArgumentException(\"\\\"name\\\" is absent or empty\");\n    }\n    List<RBAC> rbacs = new ArrayList<>();\n    List<Map<String, ?>> objects = JsonUtil.getListOfObjects(json, \"deny_rules\");\n    if (objects != null && !objects.isEmpty()) {\n      rbacs.add(\n          RBAC.newBuilder()\n          .setAction(Action.DENY)\n          .putAllPolicies(parseRules(objects, name))\n          .build());\n    }\n    objects = JsonUtil.getListOfObjects(json, \"allow_rules\");\n    if (objects == null || objects.isEmpty()) {\n      throw new IllegalArgumentException(\"\\\"allow_rules\\\" is absent\");\n    }\n    rbacs.add(\n        RBAC.newBuilder()\n        .setAction(Action.ALLOW)\n        .putAllPolicies(parseRules(objects, name))\n        .build());\n    return rbacs;\n  }\n}\n","sourceCodeStart":172,"sourceCodeEnd":200,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java#L172-L200","documentation":"A gRPC authorization policy must contain at least one allow rule. translate() reads the \"allow_rules\" array from the policy JSON and throws IllegalArgumentException when it is absent or empty; deny rules are optional, allow rules are not.","triggerScenarios":"Calling AuthorizationPolicyTranslator.translate(policyJson) where the JSON object lacks \"allow_rules\", or it is null, or an empty array — e.g. a policy that only defines deny_rules.","commonSituations":"Policy with only deny_rules, empty allow_rules after template rendering, typo like \"allowRules\" or \"allow_rule\".","solutions":["Add a non-empty \"allow_rules\" array to the authorization policy JSON","Check the field spelling is exactly \"allow_rules\" (snake_case)","Validate the policy JSON against the authz policy schema before translating","If you only need deny behavior, still define allow_rules describing what IS permitted"],"exampleFix":"// before\n{\"name\": \"p1\", \"deny_rules\": [{\"matches\": [...], \"requires\": {...}}]}\n// after\n{\"name\": \"p1\", \"deny_rules\": [...], \"allow_rules\": [{\"matches\": [{\"header\": \":path\", \"pathPrefix\": \"/svc\"}], \"requires\": {}}]}","handlingStrategy":"validation","validationCode":"JsonObject o = JsonParser.parseString(policyJson).getAsJsonObject();\nif (!o.has(\"allow_rules\") || !o.getAsJsonArray(\"allow_rules\").iterator().hasNext()) {\n  throw new IllegalArgumentException(\"policy requires non-empty 'allow_rules'\");\n}","typeGuard":"static boolean hasAllowRules(Map<String, ?> json) {\n  List<?> rules = (List<?>) json.get(\"allow_rules\");\n  return rules != null && !rules.isEmpty();\n}","tryCatchPattern":"try {\n  List<RBAC> rbacs = AuthorizationPolicyTranslator.translate(policyJson);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"allow_rules\")) { log.error(\"Policy missing allow_rules\"); }\n  throw e;\n}","preventionTips":["Always define allow_rules even when the intent is mostly deny","Check snake_case field spelling (allow_rules, deny_rules)","Validate policies against the documented authz schema before deployment"],"tags":["grpc","authz","validation","json"],"backgroundTag":"missing-required-config-field","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}