{"record":{"id":"dbc93e7506461f88","repo":"hashicorp/nomad","slug":"namespace-must-be-set-to-set-job-id","errorCode":null,"errorMessage":"namespace must be set to set job ID","messagePattern":"namespace must be set to set job ID","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":384,"sourceCode":"}\n\nfunc (a *ACLPolicy) Validate() error {\n\tvar mErr multierror.Error\n\tif !ValidPolicyName.MatchString(a.Name) {\n\t\terr := fmt.Errorf(\"invalid name '%s'\", a.Name)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif _, err := acl.Parse(a.Rules, acl.PolicyParseStrict); err != nil {\n\t\terr = fmt.Errorf(\"failed to parse rules: %v\", err)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif len(a.Description) > maxPolicyDescriptionLength {\n\t\terr := fmt.Errorf(\"description longer than %d\", maxPolicyDescriptionLength)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif a.JobACL != nil {\n\t\tif a.JobACL.JobID != \"\" && a.JobACL.Namespace == \"\" {\n\t\t\terr := fmt.Errorf(\"namespace must be set to set job ID\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t}\n\t\tif a.JobACL.Group != \"\" && a.JobACL.JobID == \"\" {\n\t\t\terr := fmt.Errorf(\"job ID must be set to set group\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t}\n\t\tif a.JobACL.Task != \"\" && a.JobACL.Group == \"\" {\n\t\t\terr := fmt.Errorf(\"group must be set to set task\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t}\n\t}\n\n\treturn mErr.ErrorOrNil()\n}\n\n// ACLPolicyListStub is used to for listing ACL policies\ntype ACLPolicyListStub struct {\n\tName        string","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L366-L402","documentation":"When an ACL policy includes a JobACL block, Validate requires Namespace to be set whenever JobID is set. A job-scoped policy is meaningless without a namespace, so Nomad rejects the policy with 'namespace must be set to set job ID'. The error is aggregated into the policy's multierror.","triggerScenarios":"Creating/updating an ACL policy whose JobACL.JobID is non-empty while JobACL.Namespace is empty (JSON API submit or the -job / templated flags in `nomad acl policy apply` that omitted namespace).","commonSituations":"Hand-crafting the JSON policy with only {\"JobID\":\"myjob\"}; API clients defaulting namespace to empty string instead of 'default'; templates that conditionally render namespace only when it differs from default.","solutions":["Set JobACL.Namespace (e.g. \"default\") whenever JobACL.JobID is provided.","Review the policy JSON sent to /v1/acl/policy and ensure namespace is populated.","If using nomad acl policy apply templating, verify the namespace placeholder resolves to a real value.","Prefer always authoring the full JobACL triple (namespace, job ID) to avoid partial objects."],"exampleFix":"// before\n\"JobACL\": {\"JobID\": \"webapp\"}\n// after\n\"JobACL\": {\"Namespace\": \"default\", \"JobID\": \"webapp\"}","handlingStrategy":"validation","validationCode":"func validateJobACL(j *JobACL) error {\n    if j != nil && j.JobID != \"\" && j.Namespace == \"\" {\n        return errors.New(\"namespace must be set when JobID is set\")\n    }\n    return nil\n}","typeGuard":"func jobACLComplete(j *structs.JobACL) bool {\n    return j == nil || j.JobID == \"\" || j.Namespace != \"\"\n}","tryCatchPattern":"if err := policy.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"namespace must be set to set job ID\") {\n        policy.JobACL.Namespace = \"default\"\n    }\n    return policy.Validate()\n}","preventionTips":["Always set Namespace (default to \"default\") when populating JobACL.JobID.","Construct JobACL objects with a helper that takes (namespace, job) together.","Avoid defaulting Namespace to \"\" in API clients; use the explicit default namespace.","Add unit tests asserting partial JobACL objects fail local validation."],"tags":["acl","validation","job-acl","namespace"],"backgroundTag":"acl-jobacl-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}