block/buzz · error · IngestError::Rejected

policy:owner_only — agent has no owner set

Error message

policy:owner_only — agent has no owner set

What it means

A third-party 9000 add targets an agent pubkey whose channel_add_policy is 'owner_only', but the agent has no registered owner — get_agent_channel_policy() returned a policy with a NULL owner. The relay cannot evaluate who is allowed to add the agent, so it fails closed rather than letting anyone add it. This is a data-integrity gap on the agent's policy row, not a judgement about the actor.

Source

Thrown at crates/buzz-relay/src/handlers/side_effects.rs:426

                    ));
                }
            }

            // Self-add: always allowed regardless of policy.
            if target_pubkey == actor_bytes {
                return Ok(());
            }

            // Third-party add: check channel_add_policy on the target.
            if let Some((policy, owner)) = state
                .db
                .get_agent_channel_policy(tenant.community(), &target_pubkey)
                .await?
            {
                match policy.as_str() {
                    "owner_only" => {
                        let owner_bytes = owner.ok_or_else(|| {
                            anyhow::anyhow!("policy:owner_only — agent has no owner set")
                        })?;
                        if actor_bytes != owner_bytes {
                            return Err(anyhow::anyhow!(
                                "policy:owner_only — only the agent owner can add this agent"
                            ));
                        }
                    }
                    "nobody" => {
                        return Err(anyhow::anyhow!(
                            "policy:nobody — this agent has disabled external channel additions"
                        ));
                    }
                    // "anyone" or any unknown value → allow.
                    // NOTE: DB ENUM constraint prevents unknown values from being stored.
                    // If a new policy value is added to the ENUM, update this match.
                    _ => {}
                }
            }

View on GitHub (pinned to f956e6fe06)

Solutions

1. Fix the agent's registration: set its NIP-OA owner (agent_owners row in this community) so owner_only has someone to match
2. Or change the policy to 'anyone' if external adds should be permitted
3. Have the agent add itself to the channel — self-add bypasses the policy check
4. Audit other owner_only agents for NULL owners; this error signals a configuration defect, not a permissions request

Example fix

# before: agent configured owner_only with no owner
# any third-party 9000 add → policy:owner_only — agent has no owner set

# after: register the owner (or relax the policy)
buzz agents set-owner --agent <agent-pubkey> --owner <owner-pubkey>
# or
buzz agents set-add-policy --agent <agent-pubkey> --policy anyone

// Pre-check the agent's policy/owner pair before a third-party add
let policy = client.get_agent_channel_policy(community, target_pubkey).await?;
if policy.as_deref() == Some("owner_only") {
    let owner = client.get_agent_owner(community, target_pubkey).await?;
    anyhow::ensure!(owner.is_some(), "agent is owner_only with no owner — data defect, fix registration");
}

match validate_admin_event(&tenant, 9000, &event, &state).await {
    Err(e) if e.to_string().contains("agent has no owner set") => {
        // not retryable by the caller: repair the agent registration (set owner or relax policy), or self-add
        report_agent_registration_defect(target_pubkey)
    }
    other => other,
}

When it happens

Trigger: An agent profile/ownership registration was partially completed: channel_add_policy set to owner_only but the agent_owners link never written (or deleted); adding such an agent to any channel by anyone other than the agent itself (self-add returns Ok before the policy check).

Common situations: Migration or backfill that populated policy values without owner rows; agent ownership revoked but policy left at owner_only; agents provisioned by tooling that skips the NIP-OA ownership declaration step.

Related errors

• policy:owner_only — only the agent owner can add this agent
• policy:nobody — this agent has disabled external channel add
• missing or invalid h tag
• channel not found
• channel is archived

AI-assisted analysis of block/buzz@f956e6fe06 (2026-08-16). Data as JSON: /api/errors/d9a7c8fd6ce77b81. Report an issue: GitHub.