elastic/elasticsearch · error · PolicyValidationException

expected [{}] to be type [boolean] but found type [{}]

Error message

expected [{}] to be type [boolean] but found type [{}]

What it means

Thrown by the checkBoolean helper in FilesEntitlement.build when the `exclusive` field is present in the entry map but its value is not a JSON boolean. The only fields accepting booleans on a files entry are `exclusive`; supplying a string "true" or a number trips this guard.

Source

Thrown at libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java:225

            }
            throw new PolicyValidationException(
                "expected ["
                    + key
                    + "] to be type ["
                    + String.class.getSimpleName()
                    + "] but found type ["
                    + value.getClass().getSimpleName()
                    + "]"
            );
        };
        BiFunction<Map<String, Object>, String, Boolean> checkBoolean = (values, key) -> {
            Object value = values.remove(key);
            if (value == null) {
                return null;
            } else if (value instanceof Boolean bool) {
                return bool;
            }
            throw new PolicyValidationException(
                "expected ["
                    + key
                    + "] to be type ["
                    + boolean.class.getSimpleName()
                    + "] but found type ["
                    + value.getClass().getSimpleName()
                    + "]"
            );
        };
        List<FileData> filesData = new ArrayList<>();
        for (Object object : paths) {
            Map<String, Object> file = new HashMap<>((Map<String, Object>) object);
            String pathAsString = checkString.apply(file, "path");
            String relativePathAsString = checkString.apply(file, "relative_path");
            String relativeTo = checkString.apply(file, "relative_to");
            String pathSetting = checkString.apply(file, "path_setting");
            String settingBaseDirAsString = checkString.apply(file, "basedir_if_relative");
            String modeAsString = checkString.apply(file, "mode");

View on GitHub (pinned to db6a809a66)

Solutions

1. Use a real JSON boolean: `true` or `false` without quotes.
2. If your policy is generated from YAML, ensure the serializer emits booleans, not strings.

Example fix

// before
{ "path": "/var/log/es", "mode": "read_write", "exclusive": "true" }

// after
{ "path": "/var/log/es", "mode": "read_write", "exclusive": true }

public static void validateExclusive(Object v) {
    if (v != null && !(v instanceof Boolean)) {
        throw new IllegalArgumentException("exclusive must be a boolean, got " + v.getClass().getSimpleName());
    }
}

public static boolean isBooleanOrNullOr(Object v) {
    return v == null || v instanceof Boolean;
}

When it happens

Trigger: A files-entitlement entry sets `exclusive` to a non-boolean value, for example `{ "exclusive": "true" }`, `{ "exclusive": 1 }`, or `{ "exclusive": "yes" }`.

Common situations: YAML-derived policy where `exclusive: true` round-tripped into a string; hand-edited JSON with quoted booleans; using 0/1 instead of false/true; locale-specific words (yes/no).

Related errors

• expected [{}] to be type [String] but found type [{}]
• invalid mode: {}, valid values: [read, read_write]
• invalid platform: {}, valid values: [linux, macos, windows]
• invalid relative directory: {}, valid values: [config, data,
• must specify at least one path

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/53e915e7f874fca3. Report an issue: GitHub.