hyperledger/fabric · error

Could not obtain collection access policy, collection name

Error message

Could not obtain collection access policy, collection name %s due to %s

What it means

After locating the collection config, the distributor calls AccessPolicy to build a collection access policy. If that call returns an error (policy cannot be constructed from the config for this channel), computeDisseminationPlan wraps and returns it.

Solutions

1. Inspect the wrapped inner error (%s due to %s) to find the policy construction failure
2. Fix the collection definition (member_orgs_policy / signature policy) and upgrade the chaincode collection config
3. Verify all orgs named in the collection config are defined in the channel MSP

// validate member orgs in collection config exist in channel MSP before use
cfg, err := collectionStore.AccessFilter(channel, config.MemberOrgsPolicy)
if err != nil || cfg == nil { /* skip or fix config */ }

if err := distribute(...); err != nil {
  if strings.Contains(err.Error(), "Could not obtain collection access policy") {
    // inspect wrapped cause, fix collection config / MSP
  }
}

When it happens

Trigger: AccessPolicy(colCP, chainID) returns an error while computing the dissemination plan — malformed static collection config, unresolved member orgs policy, or MSP/channel context failure resolving policy members.

Common situations: Collection config references organizations not in the channel MSP; invalid signature policy in the collection definition; policy evaluation fails due to missing MSP manager for the channel.

Related errors

• collection config package for
• configHistoryRetriever is not available
• Empty membership
• Failed disseminating
• Failed obtaining collection filter for channel

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/0ebe58c4090ab6bc. Report an issue: GitHub.

Appendix: source

Thrown at gossip/privdata/distributor.go:180

		namespace := pvtRwset.Namespace
		configPackage, found := privDataWithConfig.CollectionConfigs[namespace]
		if !found {
			d.logger.Error("Collection config package for", namespace, "chaincode is not provided")
			return nil, errors.New(fmt.Sprint("collection config package for", namespace, "chaincode is not provided"))
		}

		for _, collection := range pvtRwset.CollectionPvtRwset {
			colCP, err := d.getCollectionConfig(configPackage, collection)
			collectionName := collection.CollectionName
			if err != nil {
				d.logger.Error("Could not find collection access policy for", namespace, " and collection", collectionName, "error", err)
				return nil, errors.WithMessage(err, fmt.Sprint("could not find collection access policy for", namespace, " and collection", collectionName, "error", err))
			}

			colAP, err := d.AccessPolicy(colCP, d.chainID)
			if err != nil {
				d.logger.Error("Could not obtain collection access policy, collection name", collectionName, "due to", err)
				return nil, errors.Wrap(err, fmt.Sprint("Could not obtain collection access policy, collection name", collectionName, "due to", err))
			}

			colFilter := colAP.AccessFilter()
			if colFilter == nil {
				d.logger.Error("Collection access policy for", collectionName, "has no filter")
				return nil, errors.Errorf("No collection access policy filter computed for %v", collectionName)
			}

			pvtDataMsg, err := d.createPrivateDataMessage(txID, namespace, collection, &peer.CollectionConfigPackage{Config: []*peer.CollectionConfig{colCP}}, blkHt)
			if err != nil {
				return nil, errors.WithStack(err)
			}

			d.logger.Debugf("Computing dissemination plan for collection [%s]", collectionName)
			dPlan, err := d.disseminationPlanForMsg(colAP, colFilter, pvtDataMsg)
			if err != nil {
				return nil, errors.WithMessagef(err, "could not build private data dissemination plan for chaincode %s and collection %s", namespace, collectionName)
			}

View on GitHub (pinned to 2736b63f8f)