grpc/grpc-go · error

"allow_rules" is not present

Error message

"allow_rules" is not present

What it means

Raised by translatePolicy when the policy has a name but allow_rules is absent or empty. The gRPC SDK authorization model treats allow_rules as mandatory (an empty allow list would deny everything by default, which is treated as a misconfiguration); parseRules is only called when len(AllowRules) > 0, otherwise this error fires.

Source

Thrown at authz/rbac_translator.go:373

	}
}

// translatePolicy translates SDK authorization policy in JSON format to two
// Envoy RBAC polices (deny followed by allow policy) or only one Envoy RBAC
// allow policy. Also returns the overall policy name. If the input policy
// cannot be parsed or is invalid, an error will be returned.
func translatePolicy(policyStr string) ([]*v3rbacpb.RBAC, string, error) {
	policy := &authorizationPolicy{}
	d := json.NewDecoder(bytes.NewReader([]byte(policyStr)))
	d.DisallowUnknownFields()
	if err := d.Decode(policy); err != nil {
		return nil, "", fmt.Errorf("failed to unmarshal policy: %v", err)
	}
	if policy.Name == "" {
		return nil, "", fmt.Errorf(`"name" is not present`)
	}
	if len(policy.AllowRules) == 0 {
		return nil, "", fmt.Errorf(`"allow_rules" is not present`)
	}
	allowLogger, denyLogger, err := policy.AuditLoggingOptions.toProtos()
	if err != nil {
		return nil, "", err
	}
	rbacs := make([]*v3rbacpb.RBAC, 0, 2)
	if len(policy.DenyRules) > 0 {
		denyPolicies, err := parseRules(policy.DenyRules, policy.Name)
		if err != nil {
			return nil, "", fmt.Errorf(`"deny_rules" %v`, err)
		}
		denyRBAC := &v3rbacpb.RBAC{
			Action:              v3rbacpb.RBAC_DENY,
			Policies:            denyPolicies,
			AuditLoggingOptions: denyLogger,
		}
		rbacs = append(rbacs, denyRBAC)
	}

View on GitHub (pinned to 03255a9237)

Solutions

1. Add at least one allow_rules entry (e.g. a permissive catch-all rule if you want deny_rules to be the effective gate).
2. If you want 'allow all then deny some', add an allow rule with a wildcard request (paths ["/*"]).
3. Re-read the SDK schema: allow_rules is required, deny_rules is optional.
4. Lint the policy for a non-empty allow_rules array before deploy.

Example fix

// before:
{ "name": "p", "deny_rules": [ { "name": "d", "source": { "principals": ["bad"] } } ] }   // no allow_rules

// after:
{
  "name": "p",
  "allow_rules": [ { "name": "allow-all", "request": { "paths": ["/*"] } } ],
  "deny_rules": [ { "name": "d", "source": { "principals": ["bad"] } } ]
}

func validateAllowRulesPresent(policyStr string) error {
    var p struct {
        AllowRules []json.RawMessage `json:"allow_rules"`
    }
    if err := json.Unmarshal([]byte(policyStr), &p); err != nil { return err }
    if len(p.AllowRules) == 0 {
        return fmt.Errorf(`"allow_rules" is not present`) // mirrors SDK
    }
    return nil
}

When it happens

Trigger: The policy JSON omits allow_rules, sets it to [], or only supplies deny_rules. translatePolicy checks `len(policy.AllowRules) == 0` and returns this error.

Common situations: Authoring a deny-only policy and forgetting that the SDK still requires a non-empty allow_rules; a policy templating bug that drops allow_rules when it's the only meaningful block; misreading the schema where deny_rules is optional but allow_rules is required.

Related errors

• %d: %v
• "name" is not present
• "deny_rules" %v
• "allow_rules" %v
• %d: "name" is not present

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/6b709c8da98a8c2b. Report an issue: GitHub.