run-llama/llama_index · error · PermissionError

Query requires invoker identity but none provided

Error message

Query requires invoker identity but none provided

What it means

Raised by AgentMeshQueryEngine.query (sync path) when the configured policy demands verified invokers (policy.require_verification is true) and the data policy requires identity (data_policy.require_identity is true), but the caller passed no invoker_card. The engine treats an anonymous query against identity-required data as a permission violation and raises PermissionError before executing the underlying query engine.

Source

Thrown at llama-index-integrations/agent/llama-index-agent-agentmesh/llama_index/agent/agentmesh/query_engine.py:154

            query_bundle: The query to execute
            invoker_card: Optional invoker card for verification
            **kwargs: Additional arguments

        Returns:
            Query response

        Raises:
            PermissionError: If trust verification fails

        """
        verification = None
        query_text = query_bundle.query_str

        # Verify invoker if required
        if self._policy.require_verification:
            if not invoker_card:
                if self._data_policy.require_identity:
                    raise PermissionError(
                        "Query requires invoker identity but none provided"
                    )
            else:
                verification = self.verify_invoker(invoker_card)
                if not verification.trusted and self._policy.block_unverified:
                    # Log blocked query
                    if self._policy.audit_queries:
                        record = self._create_audit_record(
                            query_text, invoker_card, verification
                        )
                        record.warnings.append("Query blocked due to trust failure")
                        self._audit_log.append(record)

                    raise PermissionError(f"Query rejected: {verification.reason}")

        # Execute the underlying query
        response = self._query_engine.query(query_bundle)

View on GitHub (pinned to afd0fef371)

Solutions

1. Pass a valid invoker card: query_engine.query(query, invoker_card=my_agent_card)
2. If anonymous reads are intended, build the engine with data_policy.require_identity=False
3. If verification is not needed at all, set policy.require_verification=False

Example fix

# before
response = engine.query("summary of Q3 data")  # PermissionError

# after
response = engine.query("summary of Q3 data", invoker_card=invoker.identity_card)

def can_query_anonymously(engine) -> bool:
    policy = engine._policy
    data_policy = engine._data_policy
    return not (policy.require_verification and data_policy.require_identity)

def is_invoker_card(card) -> bool:
    """Narrow an optional invoker card to a usable object."""
    return card is not None and getattr(card, "agent_name", None) is not None

try:
    resp = engine.query(q)
except PermissionError as e:
    if "none provided" in str(e):
        raise PermissionError("engine requires identity; supply invoker_card") from e
    raise

When it happens

Trigger: Calling query_engine.query(query_bundle) — or the str-based convenience wrapper that forwards invoker_card=None — on an AgentMeshQueryEngine built with require_verification=True and require_identity=True without supplying an invoker agent card.

Common situations: Sharing a query engine whose policies were tightened after code was written so existing call sites no longer pass invoker_card; a new team member running queries without obtaining an agent identity card; misreading require_identity as applying only to writes, not reads.

Related errors

• Query rejected: {verification.reason}
• Cannot sign without private key
• code_execute_fn must be provided for CodeActAgent
• This query engine does not support retrieve, use query direc
• This query engine does not support synthesize, use query dir

AI-assisted analysis of run-llama/llama_index@afd0fef371 (2026-08-15). Data as JSON: /api/errors/1da5cdb433f379bf. Report an issue: GitHub.