grpc/grpc-java · error · IllegalArgumentException

"allow_rules" is absent

Error message

"allow_rules" is absent

What it means

A gRPC authorization policy must contain at least one allow rule. translate() reads the "allow_rules" array from the policy JSON and throws IllegalArgumentException when it is absent or empty; deny rules are optional, allow rules are not.

Source

Thrown at authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java:190

    }
    @SuppressWarnings("unchecked")
    Map<String, ?> json = (Map<String, ?>)jsonObject;
    String name = JsonUtil.getString(json, "name");
    if (name == null || name.isEmpty()) {
      throw new IllegalArgumentException("\"name\" is absent or empty");
    }
    List<RBAC> rbacs = new ArrayList<>();
    List<Map<String, ?>> objects = JsonUtil.getListOfObjects(json, "deny_rules");
    if (objects != null && !objects.isEmpty()) {
      rbacs.add(
          RBAC.newBuilder()
          .setAction(Action.DENY)
          .putAllPolicies(parseRules(objects, name))
          .build());
    }
    objects = JsonUtil.getListOfObjects(json, "allow_rules");
    if (objects == null || objects.isEmpty()) {
      throw new IllegalArgumentException("\"allow_rules\" is absent");
    }
    rbacs.add(
        RBAC.newBuilder()
        .setAction(Action.ALLOW)
        .putAllPolicies(parseRules(objects, name))
        .build());
    return rbacs;
  }
}

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Add a non-empty "allow_rules" array to the authorization policy JSON
2. Check the field spelling is exactly "allow_rules" (snake_case)
3. Validate the policy JSON against the authz policy schema before translating
4. If you only need deny behavior, still define allow_rules describing what IS permitted

Example fix

// before
{"name": "p1", "deny_rules": [{"matches": [...], "requires": {...}}]}
// after
{"name": "p1", "deny_rules": [...], "allow_rules": [{"matches": [{"header": ":path", "pathPrefix": "/svc"}], "requires": {}}]}

JsonObject o = JsonParser.parseString(policyJson).getAsJsonObject();
if (!o.has("allow_rules") || !o.getAsJsonArray("allow_rules").iterator().hasNext()) {
  throw new IllegalArgumentException("policy requires non-empty 'allow_rules'");
}

static boolean hasAllowRules(Map<String, ?> json) {
  List<?> rules = (List<?>) json.get("allow_rules");
  return rules != null && !rules.isEmpty();
}

try {
  List<RBAC> rbacs = AuthorizationPolicyTranslator.translate(policyJson);
} catch (IllegalArgumentException e) {
  if (e.getMessage().contains("allow_rules")) { log.error("Policy missing allow_rules"); }
  throw e;
}

When it happens

Trigger: Calling AuthorizationPolicyTranslator.translate(policyJson) where the JSON object lacks "allow_rules", or it is null, or an empty array — e.g. a policy that only defines deny_rules.

Common situations: Policy with only deny_rules, empty allow_rules after template rendering, typo like "allowRules" or "allow_rule".

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• "name" is absent or empty
• "key" is absent or empty
• "values" is absent or empty
• rule "name" is absent or empty
• Authorization policy should be a JSON object. Found: null

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/ce66fcd6f394ebc5. Report an issue: GitHub.