Could not obtain collection access policy, collection name %

Error message

Could not obtain collection access policy, collection name %s due to %s

What it means

After locating the collection config, the distributor calls AccessPolicy to build a collection access policy. If that call returns an error (policy cannot be constructed from the config for this channel), computeDisseminationPlan wraps and returns it.

Source

Thrown at gossip/privdata/distributor.go:180

		namespace := pvtRwset.Namespace
		configPackage, found := privDataWithConfig.CollectionConfigs[namespace]
		if !found {
			d.logger.Error("Collection config package for", namespace, "chaincode is not provided")
			return nil, errors.New(fmt.Sprint("collection config package for", namespace, "chaincode is not provided"))
		}

		for _, collection := range pvtRwset.CollectionPvtRwset {
			colCP, err := d.getCollectionConfig(configPackage, collection)
			collectionName := collection.CollectionName
			if err != nil {
				d.logger.Error("Could not find collection access policy for", namespace, " and collection", collectionName, "error", err)
				return nil, errors.WithMessage(err, fmt.Sprint("could not find collection access policy for", namespace, " and collection", collectionName, "error", err))
			}

			colAP, err := d.AccessPolicy(colCP, d.chainID)
			if err != nil {
				d.logger.Error("Could not obtain collection access policy, collection name", collectionName, "due to", err)
				return nil, errors.Wrap(err, fmt.Sprint("Could not obtain collection access policy, collection name", collectionName, "due to", err))
			}

			colFilter := colAP.AccessFilter()
			if colFilter == nil {
				d.logger.Error("Collection access policy for", collectionName, "has no filter")
				return nil, errors.Errorf("No collection access policy filter computed for %v", collectionName)
			}

			pvtDataMsg, err := d.createPrivateDataMessage(txID, namespace, collection, &peer.CollectionConfigPackage{Config: []*peer.CollectionConfig{colCP}}, blkHt)
			if err != nil {
				return nil, errors.WithStack(err)
			}

			d.logger.Debugf("Computing dissemination plan for collection [%s]", collectionName)
			dPlan, err := d.disseminationPlanForMsg(colAP, colFilter, pvtDataMsg)
			if err != nil {
				return nil, errors.WithMessagef(err, "could not build private data dissemination plan for chaincode %s and collection %s", namespace, collectionName)
			}

View on GitHub (pinned to 2736b63f8f)

Solutions

Inspect the wrapped inner error (%s due to %s) to find the policy construction failure
Fix the collection definition (member_orgs_policy / signature policy) and upgrade the chaincode collection config
Verify all orgs named in the collection config are defined in the channel MSP

Defensive patterns

Strategy: try-catch

Validate before calling

// validate member orgs in collection config exist in channel MSP before use
cfg, err := collectionStore.AccessFilter(channel, config.MemberOrgsPolicy)
if err != nil || cfg == nil { /* skip or fix config */ }

Try / catch

if err := distribute(...); err != nil {
  if strings.Contains(err.Error(), "Could not obtain collection access policy") {
    // inspect wrapped cause, fix collection config / MSP
  }
}

Prevention

Keep collection member orgs aligned with channel MSP definitions
Validate collection configs with configtxgen/chaincode upgrade checks

When it happens

Trigger: AccessPolicy(colCP, chainID) returns an error while computing the dissemination plan — malformed static collection config, unresolved member orgs policy, or MSP/channel context failure resolving policy members.

Common situations: Collection config references organizations not in the channel MSP; invalid signature policy in the collection definition; policy evaluation fails due to missing MSP manager for the channel.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/0ebe58c4090ab6bc. Report an issue: GitHub.