ruvnet/ruflo · error

Inbound authorization would deny ${message.type} from ${sour

Error message

Inbound authorization would deny ${message.type} from ${sourceNodeId} (mode=${authorizationMode})

What it means

Dry-run counterpart of the enforce denial: the evaluator decided a message of this type from this node would be denied, but the plugin is in observe/legacy mode, so the message is still dispatched. The warn exists to preview which traffic enforce mode will reject once activated.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:446

    deps.logger.warn('Inbound rejected: enforce mode has no authorization evaluator');
    return { accepted: false, reason: 'AUTHORIZATION_ERROR' };
  }

  if (authorizationDecision && !authorizationDecision.allowed) {
    if (authorizationMode === 'enforce') {
      await deps.audit.log('message_rejected', {
        sourceNodeId,
        metadata: {
          address,
          reason: 'AUTHORIZATION_DENIED',
          messageType: message.type,
          policyReason: authorizationDecision.reason,
        },
      });
      deps.logger.warn(`Inbound authorization denied for ${sourceNodeId} (addr=${address})`);
      return { accepted: false, reason: 'AUTHORIZATION_DENIED' };
    }
    deps.logger.warn(
      `Inbound authorization would deny ${message.type} from ${sourceNodeId} ` +
        `(mode=${authorizationMode})`,
    );
  }

  // Touch lastSeen on every successful inbound — drives the
  // discovery service's stale-peer detection.
  peer.markSeen();

  // Audit accepted delivery
  await deps.audit.log('message_received', {
    sourceNodeId,
    metadata: {
      address,
      messageType: message.type,
      messageId: message.id,
      authorizationMode,
      authorizationAllowed: authorizationDecision?.allowed,

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Review the authorization policy; in observe mode the would-deny is logged so policy can be tuned before enforce is enabled.

When it happens

Trigger: Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:446 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/fe530f7a0724a484. Report an issue: GitHub.