What causes "Collection config access policy is nil" in hyperledger/fabric?

Ensure each collection's memberOrgsPolicy contains a populated signaturePolicy envelope

Collection config access policy is nil

Error message

Collection config access policy is nil

What it means

Setup extracts the signature-policy envelope from the collection's MemberOrgsPolicy. This error fires when the MemberOrgsPolicy exists but contains no SignaturePolicy envelope (GetSignaturePolicy returns nil), so no access policy can be constructed. It distinguishes 'policy present but empty' from a fully missing policy.

Source

Thrown at core/common/privdata/simplecollection.go:100

}

// Setup configures a simple collection object based on a given
// StaticCollectionConfig proto that has all the necessary information
func (sc *SimpleCollection) Setup(collectionConfig *peer.StaticCollectionConfig, deserializer msp.IdentityDeserializer) error {
	if collectionConfig == nil {
		return errors.New("Nil config passed to collection setup")
	}
	sc.conf = proto.Clone(collectionConfig).(*peer.StaticCollectionConfig)
	sc.name = collectionConfig.GetName()

	// get the access signature policy envelope
	collectionPolicyConfig := collectionConfig.GetMemberOrgsPolicy()
	if collectionPolicyConfig == nil {
		return errors.New("Collection config policy is nil")
	}
	accessPolicyEnvelope := collectionPolicyConfig.GetSignaturePolicy()
	if accessPolicyEnvelope == nil {
		return errors.New("Collection config access policy is nil")
	}

	err := sc.setupAccessPolicy(collectionPolicyConfig, deserializer)
	if err != nil {
		return err
	}

	// get member org MSP IDs from the envelope, identities that fail to deserialize will not be returned
	sc.memberOrgs = getMemberOrgs(accessPolicyEnvelope.Identities, deserializer)

	return nil
}

// setupAccessPolicy configures a simple collection object based on a given
// StaticCollectionConfig proto that has all the necessary information
func (sc *SimpleCollection) setupAccessPolicy(collectionPolicyConfig *peer.CollectionPolicyConfig, deserializer msp.IdentityDeserializer) error {
	var err error
	sc.accessPolicy, err = getPolicy(collectionPolicyConfig, deserializer)

View on GitHub (pinned to 2736b63f8f)

Solutions

Ensure each collection's memberOrgsPolicy contains a populated signaturePolicy envelope
If a channel policy reference was intended, confirm the code path supports it — otherwise convert it to a signature policy
Re-approve the chaincode definition with the corrected collections config

Example fix

// before
polCfg := &peer.CollectionPolicyConfig{} // empty -> envelope nil

// after
polCfg := &peer.CollectionPolicyConfig{
  Payload: &peer.CollectionPolicyConfig_SignaturePolicy{
    SignaturePolicy: cauthdsl.SignedByMspMember("Org1MSP"),
  },
}

Defensive patterns

Strategy: validation

Validate before calling

pol := cfg.GetMemberOrgsPolicy()
if pol != nil && pol.GetSignaturePolicy() == nil {
  return errors.New("memberOrgsPolicy present but signaturePolicy envelope missing")
}

Type guard

func hasSignatureEnvelope(c *peer.CollectionPolicyConfig) bool {
  return c != nil && c.GetSignaturePolicy() != nil
}

Try / catch

if err := sc.Setup(cfg, deserializer); err != nil {
  if strings.Contains(err.Error(), "access policy is nil") {
    return fmt.Errorf("collection policy has no signature envelope: %w", err)
  }
  return err
}

Prevention

Build member orgs policies with cauthdsl helpers (SignedByMspMember etc.), never zero-value structs
Reject non-signature policy payloads where signaturePolicy is required
Test Setup() on every collection in CI before deploying

When it happens

Trigger: A CollectionPolicyConfig built with a channel-level/reference policy or an empty payload instead of a signature_policy, passed through the collection config into SimpleCollection.Setup.

Common situations: Mixing policy types when authoring collections config (e.g., setting channelConfigPolicy reference where signaturePolicy is required), programmatically built CollectionPolicyConfig left zero-valued, upgrade from config formats that dropped signature policies.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/b83e56bbd9f6ec3f. Report an issue: GitHub.