nanocoai/nanoclaw · warning

Delivery action denied by guard

Error message

Delivery action denied by guard

What it means

A privileged delivery action (e.g. schedule, approval, self-mod) was evaluated by the guard seam and explicitly denied. The message is dropped after `spec.onDeny` runs; this is a policy decision, not a crash.

Source

Thrown at src/delivery-guard.ts:54

 */
export async function runGuarded(
  action: string,
  spec: DeliveryGuardSpec,
  handler: GuardedDeliveryHandler,
  content: Record<string, unknown>,
  session: Session,
  grant: PendingApproval | null,
): Promise<void> {
  if (spec.precheck && !(await spec.precheck(content, session))) return;

  const decision = await guard(spec.guardAction, {
    actor: { kind: 'agent', agentGroupId: session.agent_group_id, sessionId: session.id },
    payload: content,
    grant,
  });

  if (decision.effect === 'deny') {
    log.warn('Delivery action denied by guard', { action, reason: decision.reason });
    await spec.onDeny?.(content, session, decision.reason);
    return;
  }
  if (decision.effect === 'hold') {
    await spec.requestHold(content, session);
    return;
  }
  await handler(content, session);
}

View on GitHub (pinned to 294ef2aee8)

Solutions

1. Check the guard reason in the same log line to see which rule denied
2. Grant the needed role/permission (`ncl roles grant`, members add) or widen `cli_scope` appropriately
3. If the denial is wrong, fix the rule in `src/guard/` module-edge adapters

if (decision.effect === 'deny') { /* read decision.reason; degrade gracefully, inform the user */ }

When it happens

Trigger: `runGuarded` calls `guard(action, input)` with the session's agent identity and the guard returns `{effect:'deny', reason}` — e.g. an agent tries a CLI-scoped or cross-group action its `cli_scope` or role does not permit.

Common situations: Agent attempts a privileged action (self-mod, cross-group delivery, approval replay) without owner/admin grant; a tightened permissions policy or `cli_scope: disabled|group` rejecting the call.

Related errors

• --user is required
• owner role is always global (do not pass --group)
• role not found
• approval-pending
• Failed to chmod ncl socket (continuing)

AI-assisted analysis of nanocoai/nanoclaw@294ef2aee8 (2026-08-28). Data as JSON: /api/errors/f10561d43eec43c4. Report an issue: GitHub.