hyperledger/fabric · error

no such policy

Error message

no such policy

What it means

Sentinel 'no such policy' returned when policy evaluation cannot resolve a referenced policy — used by callers (and tests) to detect a missing/unregistered policy path during signature set verification and config delta validation.

Source

Thrown at common/cauthdsl/policy.go:88

	return &policy{
		evaluator:               compiled,
		deserializer:            pp.Deserializer,
		signaturePolicyEnvelope: sigPolicy,
	}, nil
}

type policy struct {
	signaturePolicyEnvelope *cb.SignaturePolicyEnvelope
	evaluator               func([]msp.Identity, []bool) bool
	deserializer            msp.IdentityDeserializer
}

// EvaluateSignedData takes a set of SignedData and evaluates whether
// 1) the signatures are valid over the related message
// 2) the signing identities satisfy the policy
func (p *policy) EvaluateSignedData(signatureSet []*protoutil.SignedData) error {
	if p == nil {
		return errors.New("no such policy")
	}

	ids := policies.SignatureSetToValidIdentities(signatureSet, p.deserializer)

	return p.EvaluateIdentities(ids)
}

// EvaluateIdentities takes an array of identities and evaluates whether
// they satisfy the policy
func (p *policy) EvaluateIdentities(identities []msp.Identity) error {
	if p == nil {
		return fmt.Errorf("No such policy")
	}

	ok := p.evaluator(identities, make([]bool, len(identities)))
	if !ok {
		return errors.New("signature set did not satisfy policy")
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Check manager.GetPolicy(...) for nil before evaluating, and surface a clear 'policy not found' error to the caller
2. Define the referenced policy (e.g. Readers/Writers/Admins) in the channel configuration
3. Verify the policy ID/path string matches what was registered

Example fix

// before
p, _ := mgr.GetPolicy("/Channel/Writers")
err := p.EvaluateSignedData(sd) // nil policy
// after
p, ok := mgr.GetPolicy("/Channel/Writers")
if p == nil {
    return errors.New("policy /Channel/Writers not defined")
}
err := p.EvaluateSignedData(sd)

p := mgr.GetPolicy(policyID)
if p == nil {
    return fmt.Errorf("policy %q not defined in channel config", policyID)
}

func policyExists(mgr policies.PolicyManager, id string) bool { return mgr.GetPolicy(id) != nil }

err := pol.EvaluateSignedData(sigSet)
if err != nil && err.Error() == "no such policy" {
    return fmt.Errorf("policy %q missing from channel configuration", id)
}

When it happens

Trigger: Obtaining a policy from a PolicyManager (e.g. manager.GetPolicy(id) returning nil) and then calling EvaluateSignedData on the nil result, as in TestRejectOnUnknown.

Common situations: Requesting a policy path/ID that was never defined in channel config (typo or missing configtx policy); checking endorsement before the policy manager finished initialization.

Related errors

• No such policy
• nil policy field
• could not retrieve policy for reference '%s' on channel '%s'
• Invalid signed proposal during channelless check policy with
• organization %s not found

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/059ed5a701901d16. Report an issue: GitHub.