agent's scan passed the allowlist but failed production policy: config error
Fixes an agent whose scan passed the allowlist but failed production policy: run both policy tiers. Use when allowlist-clean code still violates policy. Not for scanner misconfiguration.
TL;DR
The allowlist tunes the scanner; production policy is a separate, stricter gate. Run both: the scanner with its allowlist for triage, and the policy check as the deploy gate, and reconcile the two lists.
Error
agent's scan passed the allowlist but failed production policy: config errorSteps
- Read the production policy failure: which rule fired that the allowlist suppressed. Expected: the gap named.
- Decide: is the policy right (then the allowlist entry is wrong) or is the policy too strict (then request an exception). Expected: a verdict.
- Align the two: allowlist entries that violate policy need policy exceptions, not silent scanner passes. Expected: one consistent story.
- Run the policy check in CI before deploy, not just the scanner. Expected: the gate enforced.
- Review allowlist versus policy quarterly; they drift. Expected: no silent divergence.
When to use
- Allowlist passes but policy fails.
- Designing two-tier secret controls.
When not to use
- Scanner misconfiguration (fix the scanner).
- Policy is simply wrong (change the policy).
Tool compatibility
- Scanner allowlists; policy engines.
Variant phrasings
allowlist passed but policy failed
Reconcile the tiers.
scan clean, deploy blocked
Policy is the gate.
Why it happens
Two systems with two exception lists diverge; each thinks the other approved.
Edge cases
- Emergency exceptions need expiry, or they become permanent.
- Policy checks must run on the same content the scanner saw.
- Document which tier owns which decision.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_Tu9WLQUMZbqziqvs7Ol0Yw