validation of endorsement policy for collection %s chaincode

Error message

validation of endorsement policy for collection %s chaincode %s in tx %d:%d failed

What it means

The v2.0 state-based validator's CheckCCEPIfNotChecked, when a collection-specific endorsement policy (collEP) exists, evaluates it against the transaction's signature set. Failure is wrapped in this error naming the collection, chaincode, block and tx, marking the transaction invalid.

Source

Thrown at core/common/validation/statebased/v20.go:123

func (p *policyCheckerV20) CheckCCEPIfNotChecked(cc, coll string, blockNum, txNum uint64, sd []*protoutil.SignedData) commonerrors.TxValidationError {
	if coll != "" {
		// at first we check whether we have already evaluated an endorsement
		// policy for this collection
		if p.nsEPChecked[coll] {
			return nil
		}

		// if not, we fetch the collection endorsement policy
		collEP, err := p.fetchCollEP(cc, coll)
		if err != nil {
			return err
		}

		// if there is an endorsement policy for the collection, we evaluate it
		if len(collEP) != 0 {
			err := p.policySupport.Evaluate(collEP, sd)
			if err != nil {
				return policyErr(errors.Wrapf(err, "validation of endorsement policy for collection %s chaincode %s in tx %d:%d failed", coll, cc, blockNum, txNum))
			}

			p.nsEPChecked[coll] = true
			p.someEPChecked = true
			return nil
		}
	}

	// we're here either because we're not in a collection or because there was
	// no endorsement policy for that collection - we turn to the chaincode EP
	if p.nsEPChecked[""] {
		return nil
	}

	// evaluate the cc EP
	err := p.policySupport.Evaluate(p.ccEP, sd)
	if err != nil {
		return policyErr(errors.Wrapf(err, "validation of endorsement policy for chaincode %s in tx %d:%d failed", cc, blockNum, txNum))

View on GitHub (pinned to 2736b63f8f)

Solutions

Collect endorsements satisfying the collection's endorsement policy (query its config via qscc/_collections)
Re-run endorsement after any SetCollectionEP/policy change
Ensure all orgs named in the collection EP have peers and their signatures are included
Verify key-level endorsement metadata for the collection is what you expect via GetPrivateDataValidationParameter

Defensive patterns

Strategy: validation

Validate before calling

collEP, _ := validator.GetPrivateDataValidationParameter(cc, coll, key)
if len(collEP) != 0 && !satisfies(collEP, signatureSet) { return errors.New("collection EP not satisfied") }

Prevention

Check collection endorsement policy config before writing private data keys
Update client endorsement collection logic after SetCollectionEP changes
Verify which collections each key belongs to (hash-based mapping)

When it happens

Trigger: Validating a rwset entry for a private data collection whose collection-level endorsement policy (set via key-level endorsement or collection config) is not satisfied by the transaction's endorsements.

Common situations: Private data collections with EP requiring an org that did not sign; collection endorsement policy changed (SetCollectionEP) after endorsement; client unaware a key resides in a collection with stricter endorsement requirements.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/4b349cb7b21a3882. Report an issue: GitHub.