hyperledger/fabric · error

invalid member org policy for collection '%s'

Error message

invalid member org policy for collection '%s'

What it means

Wrapped EnvelopeBasedPolicyProvider.NewPolicy failure while compiling a collection's member org policy: the signature policy envelope is semantically invalid (e.g. bad version or principal) — the wrapped error has details.

Source

Thrown at core/chaincode/lifecycle/scc.go:843

		}
	}
	return nil
}

// validateCollectionConfigMemberOrgsPolicy checks whether the supplied collection configuration
// complies to the given msp configuration
func validateCollectionConfigMemberOrgsPolicy(coll *pb.StaticCollectionConfig, mspMgr msp.MSPManager) error {
	if coll.MemberOrgsPolicy == nil {
		return errors.Errorf("collection member policy is not set for collection '%s'", coll.Name)
	}
	if coll.MemberOrgsPolicy.GetSignaturePolicy() == nil {
		return errors.Errorf("collection member org policy is empty for collection '%s'", coll.Name)
	}

	// calling this constructor ensures extra semantic validation for the policy
	pp := &cauthdsl.EnvelopeBasedPolicyProvider{Deserializer: mspMgr}
	if _, err := pp.NewPolicy(coll.MemberOrgsPolicy.GetSignaturePolicy()); err != nil {
		return errors.WithMessagef(err, "invalid member org policy for collection '%s'", coll.Name)
	}

	// make sure that the signature policy is meaningful (only consists of ORs)
	if err := validateSpOrConcat(coll.MemberOrgsPolicy.GetSignaturePolicy().Rule); err != nil {
		return errors.WithMessagef(err, "collection-name: %s -- error in member org policy", coll.Name)
	}

	msps, err := mspMgr.GetMSPs()
	if err != nil {
		return errors.Wrapf(err, "could not get MSPs")
	}

	// make sure that the orgs listed are actually part of the channel
	// check all principals in the signature policy
	for _, principal := range coll.MemberOrgsPolicy.GetSignaturePolicy().Identities {
		var orgID string
		// the member org policy only supports certain principal types
		switch principal.PrincipalClassification {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Fix the collection's signature policy per the wrapped error
2. Use OR-joined OR('OrgMSP.member', ...) style policies for collection members

When it happens

Trigger: Thrown at core/chaincode/lifecycle/scc.go:843 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/0e3e8d84582189dd. Report an issue: GitHub.