hyperledger/fabric · error

permission denied

Error message

permission denied

What it means

SigFilter.Apply policy evaluation result: the message's signatures did not satisfy the channel policy (normally Writers; in maintenance mode the orderer Writers policy). The submitter is not authorized to send this message to the channel — this is an authorization failure, not a malformed message.

Source

Thrown at orderer/common/msgprocessor/sigfilter.go:77

	}

	// In maintenance mode, we typically require the signature of /Channel/Orderer/Writers.
	// This will filter out configuration changes that are not related to consensus-type migration
	// (e.g on /Channel/Application), and will block Deliver requests from peers (which are normally /Channel/Readers).
	policyName := sf.normalPolicyName
	if ordererConf.ConsensusState() == orderer.ConsensusType_STATE_MAINTENANCE {
		policyName = sf.maintenancePolicyName
	}

	policy, ok := sf.support.PolicyManager().GetPolicy(policyName)
	if !ok {
		return fmt.Errorf("could not find policy %s", policyName)
	}

	err = policy.EvaluateSignedData(signedData)
	if err != nil {
		logger.Warnw("SigFilter evaluation failed", "error", err.Error(), "ConsensusState", ordererConf.ConsensusState(), "policyName", policyName, "signingIdentity", protoutil.LogMessageForSerializedIdentities(signedData))
		return errors.Wrap(errors.WithStack(ErrPermissionDenied), err.Error())
	}
	return nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Submit the message from an identity that satisfies the channel's Writers policy
2. Update the channel policy to authorize the submitter's organization

When it happens

Trigger: Thrown at orderer/common/msgprocessor/sigfilter.go:77 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/c914fde117a1a448. Report an issue: GitHub.