{"record":{"id":"d26c1dfd62a4139b","repo":"hashicorp/nomad","slug":"management-token-cannot-be-associated-with-policie","errorCode":null,"errorMessage":"management token cannot be associated with policies or roles","messagePattern":"management token cannot be associated with policies or roles","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":775,"sourceCode":"func (a *ACLToken) Validate(minTTL, maxTTL time.Duration, existing *ACLToken) error {\n\tvar mErr multierror.Error\n\n\t// The human friendly name of an ACL token cannot exceed 256 characters.\n\tif len(a.Name) > maxTokenNameLength {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"token name too long\"))\n\t}\n\n\t// The type of an ACL token must be set. An ACL token of type client must\n\t// have associated policies or roles, whereas a management token cannot be\n\t// associated with policies.\n\tswitch a.Type {\n\tcase ACLClientToken:\n\t\tif len(a.Policies) == 0 && len(a.Roles) == 0 {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"client token missing policies or roles\"))\n\t\t}\n\tcase ACLManagementToken:\n\t\tif len(a.Policies) != 0 || len(a.Roles) != 0 {\n\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"management token cannot be associated with policies or roles\"))\n\t\t}\n\tdefault:\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"token type must be client or management\"))\n\t}\n\n\t// There are different validation rules depending on whether the ACL token\n\t// is being created or updated.\n\tswitch existing {\n\tcase nil:\n\t\tif a.ExpirationTTL < 0 {\n\t\t\tmErr.Errors = append(mErr.Errors,\n\t\t\t\tfmt.Errorf(\"token expiration TTL '%s' should not be negative\", a.ExpirationTTL))\n\t\t}\n\n\t\tif a.ExpirationTime != nil && !a.ExpirationTime.IsZero() {\n\n\t\t\tif a.CreateTime.After(*a.ExpirationTime) {\n\t\t\t\tmErr.Errors = append(mErr.Errors, errors.New(\"expiration time cannot be before create time\"))","sourceCodeStart":757,"sourceCodeEnd":793,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L757-L793","documentation":"Appended by ACLToken.Validate when a management-type token has policies or roles attached. Management tokens implicitly grant all privileges and cannot be scoped; only client tokens carry explicit policy/role links.","triggerScenarios":"Upserting an ACLToken with Type == \"management\" while Policies or Roles is non-empty.","commonSituations":"Cloning an existing client token and changing only its Type to management while keeping the old policy/role lists; scripts that copy token structs and flip the type field.","solutions":["Set Policies and Roles to empty lists when Type is management","Keep Type as client if you need the attached policies/roles","Strip the policy/role fields when converting a token to management type"],"exampleFix":"// before\ntoken.Type = \"management\" // Policies still populated\n// after\ntoken.Type = \"management\"\ntoken.Policies = []string{}\ntoken.Roles = []string{}","handlingStrategy":"validation","validationCode":"if token.Type == \"management\" && (len(token.Policies) != 0 || len(token.Roles) != 0) {\n    return errors.New(\"management tokens cannot have policies or roles\")\n}","typeGuard":"func managementTokenUnscoped(t *structs.ACLToken) bool {\n    return t.Type != structs.ACLManagementToken || (len(t.Policies) == 0 && len(t.Roles) == 0)\n}","tryCatchPattern":"if err := token.Validate(minTTL, maxTTL, nil); err != nil {\n    if strings.Contains(err.Error(), \"management token cannot be associated\") {\n        token.Policies, token.Roles = nil, nil\n        err = token.Validate(minTTL, maxTTL, nil)\n    }\n}","preventionTips":["Clear Policies/Roles when setting Type to management","Never flip a client token to management without stripping its grants","Prefer client tokens with policies; use management tokens sparingly"],"tags":["nomad","acl","token","validation"],"backgroundTag":"input-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}