{"record":{"id":"d082d7e6a21c055b","repo":"hyperledger/fabric","slug":"could-not-find-policy-s-d082d7","errorCode":null,"errorMessage":"could not find policy %s","messagePattern":"could not find policy (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"orderer/consensus/smartbft/chain.go","lineNumber":660,"sourceCode":"\n\t\tAccessController: &chainACL{\n\t\t\tpolicyManager: policyManager,\n\t\t\tLogger:        logger,\n\t\t},\n\t\tLedger: support,\n\t}\n}\n\ntype chainACL struct {\n\tpolicyManager policies.Manager\n\tLogger        *flogging.FabricLogger\n}\n\n// Evaluate evaluates signed data\nfunc (c *chainACL) Evaluate(signatureSet []*protoutil.SignedData) error {\n\tpolicy, ok := c.policyManager.GetPolicy(policies.ChannelWriters)\n\tif !ok {\n\t\treturn fmt.Errorf(\"could not find policy %s\", policies.ChannelWriters)\n\t}\n\n\terr := policy.EvaluateSignedData(signatureSet)\n\tif err != nil {\n\t\tc.Logger.Debugf(\"SigFilter evaluation failed: %s, policyName: %s\", err.Error(), policies.ChannelWriters)\n\t\treturn errors.Wrap(errors.WithStack(msgprocessor.ErrPermissionDenied), err.Error())\n\t}\n\treturn nil\n}\n","sourceCodeStart":642,"sourceCodeEnd":670,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/consensus/smartbft/chain.go#L642-L670","documentation":"Returned by chainACL.Evaluate when the channel's policy manager cannot resolve the ChannelWriters policy needed to authorize writers. Evaluate guards message submission on BFT channels; without the policy it cannot verify the signature set, so it fails closed. Normally this wraps ErrPermissionDenied for evaluation failures.","triggerScenarios":"Order/Configure path invokes Evaluate with a signature set while the channel's policy manager lacks the 'Writers' policy — e.g. channel config not fully loaded at startup, or a config update removed/renamed the Writers policy.","commonSituations":"Orderer starting before the channel's config chain is replayed; corrupted or hand-edited channel config missing Application/Orderer Writers policy; genesis block created with malformed policy definitions; config update that accidentally deleted the Writers policy.","solutions":["Verify the channel config (configtx.yaml) defines the Orderer/'Writers' policy (ChannelWriters) in the genesis block","Restart the orderer so the channel config chain fully loads before accepting submits","Restore the Writers policy via a config update if a recent update removed it","Check policyManager initialization order — Evaluate should not be reachable before policies are registered"],"exampleFix":"// before\n// genesis created without Writers policy -> could not find policy /Channel/Writers\n\n// after\n# configtx.yaml\nOrderer: &OrdererDefaults\n  Policies:\n    Writers:\n      Type: ImplicitMeta\n      Rule: \"ANY Admins\"","handlingStrategy":"try-catch","validationCode":"// Pre-flight: verify the channel's policy manager resolves Writers before submitting\npm := policyManagerForChannel(chID)\nif _, ok := pm.GetPolicy(policies.ChannelWriters); !ok {\n    return fmt.Errorf(\"channel %s missing %s policy; check genesis/config\", chID, policies.ChannelWriters)\n}","typeGuard":"func hasWritersPolicy(pm policies.Manager) bool {\n    _, ok := pm.GetPolicy(policies.ChannelWriters)\n    return ok\n}","tryCatchPattern":"if err := chainACL.Evaluate(sigSet); err != nil {\n    if strings.Contains(err.Error(), \"could not find policy\") {\n        // config not loaded or policy removed: reload channel config or fail fast\n        return fmt.Errorf(\"channel policy unavailable: %w\", err)\n    }\n    if errors.Is(err, msgprocessor.ErrPermissionDenied) {\n        return fmt.Errorf(\"caller not authorized as writer: %w\", err)\n    }\n    return err\n}","preventionTips":["Ensure configtx.yaml defines Writers (ImplicitMeta ANY Admins or explicit signature policy) for both Orderer and Application groups","Never hand-edit or regenerate genesis blocks without policy sections","Confirm orderer finishes channel config replay before accepting submits","Audit config updates for accidental policy removal before applying them"],"tags":["acl","policy","authorization","orderer"],"backgroundTag":"missing-policy-definition","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}