grpc/grpc-go · error

"allow_rules" %v

Error message

"allow_rules" %v

What it means

Raised by translatePolicy when parseRules fails on the (mandatory) allow_rules array; the wrapped %v is the underlying parseRules error (error 82 or 83). Because allow_rules is always parsed, this is the most common surface for a malformed rule — the prefix "allow_rules" disambiguates it from the deny variant (error 90).

Source

Thrown at authz/rbac_translator.go:394

	if err != nil {
		return nil, "", err
	}
	rbacs := make([]*v3rbacpb.RBAC, 0, 2)
	if len(policy.DenyRules) > 0 {
		denyPolicies, err := parseRules(policy.DenyRules, policy.Name)
		if err != nil {
			return nil, "", fmt.Errorf(`"deny_rules" %v`, err)
		}
		denyRBAC := &v3rbacpb.RBAC{
			Action:              v3rbacpb.RBAC_DENY,
			Policies:            denyPolicies,
			AuditLoggingOptions: denyLogger,
		}
		rbacs = append(rbacs, denyRBAC)
	}
	allowPolicies, err := parseRules(policy.AllowRules, policy.Name)
	if err != nil {
		return nil, "", fmt.Errorf(`"allow_rules" %v`, err)
	}
	allowRBAC := &v3rbacpb.RBAC{Action: v3rbacpb.RBAC_ALLOW, Policies: allowPolicies, AuditLoggingOptions: allowLogger}
	return append(rbacs, allowRBAC), policy.Name, nil
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Read the wrapped %v for the rule index and specific sub-error.
2. Fix the named allow_rules entry (name field or request block).
3. Add a unit test parsing allow_rules through the translator to catch this pre-deploy.
4. Validate every allow rule has a unique name and a well-formed request.

Example fix

// before:
"allow_rules": [ { "request": { "paths": ["/api"] } } ]   // missing "name"

// after:
"allow_rules": [ { "name": "allow-api", "request": { "paths": ["/api"] } } ]

// Reuse validateRuleNames/validateRuleRequests scoped to allow_rules.
func validateAllowRules(policyStr string) error {
    var p struct {
        AllowRules []struct {
            Name    string          `json:"name"`
            Request json.RawMessage `json:"request"`
        } `json:"allow_rules"`
    }
    if err := json.Unmarshal([]byte(policyStr), &p); err != nil { return err }
    for i, r := range p.AllowRules {
        if r.Name == "" {
            return fmt.Errorf(`"allow_rules"[%d]: "name" is not present`, i)
        }
    }
    return nil
}

When it happens

Trigger: An allow_rules entry is missing its name, or its request block fails parseRequest/parsePaths/parseHeaders. translatePolicy wraps the parseRules error with the "allow_rules" prefix.

Common situations: Same shape as errors 82/83 but surfaced through the allow path: copy-pasted rule without a name, a typo in a path/header matcher, or a schema mismatch after an SDK upgrade.

Related errors

• %d: %v
• "name" is not present
• "allow_rules" is not present
• "deny_rules" %v
• %d: "name" is not present

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/8b02a2de149f4444. Report an issue: GitHub.