invalid max_risk %q: must be one of read|write|high-risk-wri

Error message

invalid max_risk %q: must be one of read|write|high-risk-write

What it means

ValidateRule rejects rules whose MaxRisk field is set but is not a valid risk level. The only accepted values are read, write, and high-risk-write. This is a pure input validation with no wrapping — the message names the offending value verbatim.

Source

Thrown at internal/cmdpolicy/validate.go:38

//   - bad MaxRisk string ("readd") would skip the risk check entirely
//   - malformed doublestar pattern ("docs/[abc") never matches, so a
//     plugin that meant to allow "docs/*" silently allows nothing,
//     and a deny list with the same typo silently denies nothing
//
// A typo in either field by a plugin author or admin must abort the load
// rather than continue with a degraded rule (hard-constraint #6 / #11
// safety contract).
//
// A nil rule is a no-op (treated as "no restriction" everywhere -- not an
// error).
func ValidateRule(r *platform.Rule) error {
	if r == nil {
		return nil
	}

	if r.MaxRisk != "" {
		if !r.MaxRisk.IsValid() {
			return fmt.Errorf("invalid max_risk %q: must be one of read|write|high-risk-write", r.MaxRisk)
		}
	}

	for _, id := range r.Identities {
		if !id.IsValid() {
			return fmt.Errorf("invalid identities entry %q: must be 'user' or 'bot'", id)
		}
	}

	for _, g := range r.Allow {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid allow glob %q: %w", g, err)
		}
	}
	for _, g := range r.Deny {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid deny glob %q: %w", g, err)
		}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Set max_risk to exactly one of: read, write, high-risk-write (lowercase)
Check for typos or uppercase; the value is case-sensitive per the enum
If the intent was stronger restriction than the enum offers, use high-risk-write and enforce extra limits via identities
Remove the max_risk field entirely if no limit is intended (empty is valid)

Example fix

// before (policy.yaml)
rules:
  - max_risk: "ADMIN"
// after
rules:
  - max_risk: "high-risk-write"

Defensive patterns

Strategy: validation

Validate before calling

var validMaxRisk = map[string]bool{"read": true, "write": true, "high-risk-write": true}
if r.MaxRisk != "" && !validMaxRisk[r.MaxRisk] {
    return fmt.Errorf("max_risk %q invalid; use read|write|high-risk-write", r.MaxRisk)
}

Prevention

Only use the exact lowercase strings read, write, high-risk-write
Omit max_risk entirely when no restriction is intended
Share a constants file for risk levels across tools that generate policies
Run ValidateRule over policy files in CI before deployment

When it happens

Trigger: ValidateRule (via Resolve or LoadYAMLPolicy) receives a rule with MaxRisk set to any string other than the three valid enum values, e.g. 'admin', 'rw', 'WRITE', 'dangerous'.

Common situations: Typo or casing mistakes in policy YAML or plugin rule definitions, copying max_risk values from other tools' schemas, or rules written against an older/imagined version of the risk taxonomy.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/c06b670ff51e3525. Report an issue: GitHub.