Inbound rejected: enforce mode has no authorization evaluato

Error message

Inbound rejected: enforce mode has no authorization evaluator

What it means

Guard in dispatchInbound: authorizationMode is 'enforce' but no authorizeInbound evaluator was wired into the dispatcher dependencies. Rather than silently admitting unauthorized traffic, the message is rejected with reason AUTHORIZATION_ERROR and audited as message_rejected.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:428

    } catch {
      if (authorizationMode === 'enforce') {
        await deps.audit.log('message_rejected', {
          sourceNodeId,
          metadata: { address, reason: 'AUTHORIZATION_ERROR', messageType: message.type },
        });
        deps.logger.warn(`Inbound authorization failed for ${sourceNodeId} (addr=${address})`);
        return { accepted: false, reason: 'AUTHORIZATION_ERROR' };
      }
      deps.logger.warn(
        `Inbound authorization observation failed for ${sourceNodeId} (mode=${authorizationMode})`,
      );
    }
  } else if (authorizationMode === 'enforce') {
    await deps.audit.log('message_rejected', {
      sourceNodeId,
      metadata: { address, reason: 'AUTHORIZATION_ERROR', messageType: message.type },
    });
    deps.logger.warn('Inbound rejected: enforce mode has no authorization evaluator');
    return { accepted: false, reason: 'AUTHORIZATION_ERROR' };
  }

  if (authorizationDecision && !authorizationDecision.allowed) {
    if (authorizationMode === 'enforce') {
      await deps.audit.log('message_rejected', {
        sourceNodeId,
        metadata: {
          address,
          reason: 'AUTHORIZATION_DENIED',
          messageType: message.type,
          policyReason: authorizationDecision.reason,
        },
      });
      deps.logger.warn(`Inbound authorization denied for ${sourceNodeId} (addr=${address})`);
      return { accepted: false, reason: 'AUTHORIZATION_DENIED' };
    }
    deps.logger.warn(

View on GitHub (pinned to fa13ee4ad6)

Solutions

Configure an authorization evaluator before switching to enforce mode; enforce without an evaluator rejects all inbound.

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:428 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/972063a0caff7a16. Report an issue: GitHub.