Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In agentgateway, a CEL evaluation error does not always deny a request. A failing deny expression does not match and therefore does not deny by itself; a failing require expression denies the request. For mandatory checks such as a JWT audience, use a positive require condition, and verify that the referenced claim exists in the policy’s evaluation context.
How CEL errors change authorization decisions
Agentgateway treats a CEL expression it cannot evaluate as false. What happens next depends on the authorization action attached to that expression. The standalone HTTP authorization guide states that a false or errored require denies the request, while an errored deny does not match and does not deny it. These are distinct semantics, not two descriptions of a universal “error means deny” rule. See the standalone HTTP authorization documentation.
| Action | What triggers its effect | False or evaluation error | Effect on final decision |
|---|---|---|---|
deny |
The expression matches. | Does not match. | This rule does not deny. Other rules still determine the outcome. |
require |
The expression must be true. | Fails the requirement. | The request is denied. |
Why a `deny` expression can fail open
Consider a standalone HTTP authorization rule written as deny: 'jwt.aud != "my-service"'. It looks like it denies a caller whose audience is not my-service. But if the JWT context or its aud field is unavailable, CEL cannot evaluate the comparison. The expression becomes false, so this particular deny rule does not match.
That does not prove the request will be allowed: another matching Deny or a failed Require can still reject it. The final result also depends on the rest of the rule set. The standalone guide says that a configuration with no rules allows a request; if there is no Allow rule, unmatched traffic is allowed under denylist semantics, while an existing Allow list makes unmatched traffic denied. That is why an errored Deny can create a fail-open path, but it is not a guarantee that every request will pass.
#1 Best Overall
Why `require` fails closed
A require rule is a positive assertion: its expression must evaluate to true. For a mandatory JWT audience, the standalone form is require: 'jwt.aud == "my-service"'. If the audience is missing or the JWT context cannot be resolved, the expression is false or errors, and the request is denied.
In Kubernetes policy configuration, make the JWT claims available by configuring JWT authentication in the policy. A policy may be accepted and attached even when an expression refers to a JWT context that is not established; that reference can fail to match and deny traffic. Consult the Kubernetes authorization documentation for that policy format and its configuration requirements.
How the complete rule set determines the result
For the standalone HTTP authorization configuration, the documented evaluation order is:
- If there are no rules, the request is allowed.
- If any Deny rule matches, the request is denied.
- If any Require rule fails to match, the request is denied; every Require rule must match.
- If any Allow rule matches, the request is allowed.
- If nothing matches, the request is allowed when there are no Allow rules, and denied when an Allow list exists.
In the Kubernetes policy format, each authorization block has one action. To express multiple actions, use separate AgentgatewayPolicy resources. Allow expressions are ORed, Require expressions are ANDed, and Deny has precedence. Do not assume that standalone YAML examples and Kubernetes CRD configuration have interchangeable syntax; use the documentation for the format you deploy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check that each CEL field exists at the policy phase
A syntactically valid expression can still refer to a field that is unavailable when the policy is evaluated. Agentgateway’s CEL variable reference explains that available variables differ by policy phase. For policies usable with both directly addressed and Service backends, check has(backend.endpoint) before reading backend.endpoint. The variables guide also notes that the request body need not be buffered when no CEL expression depends on it. Review the Kubernetes CEL variables and functions reference.
There is also a reported, version-specific MCP authorization issue involving post-request fields such as mcp.tool.arguments, mcp.tool.result, and mcp.tool.error. The report describes authorization expressions that fail to match or deny calls when those fields are referenced, and warns that a guard such as has(...) || ... can make a condition permissive if it treats an unavailable field as sufficient. This issue is not evidence that every MCP configuration behaves that way; verify the behavior in the release and policy phase you use. See agentgateway issue #3092.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Checklist for safer CEL authorization
- Decide whether the policy expresses a mandatory positive condition or an exception list. Use
requirefor mandatory identity and claim assertions; reservedenyfor conditions intended to match and block. - Confirm that authentication establishes the context the expression reads. Missing or invalid JWT credentials may fail during authentication; an absent JWT context at authorization time can instead make a CEL reference fail.
- Check the CEL variable reference for the exact deployment format and policy phase. Do not assume a field is available merely because its name is valid CEL syntax.
- Test absent claims, absent headers, and unavailable fields in the agentgateway CEL playground and through a representative request flow. The standalone CEL expressions documentation describes CEL expression support.
- Review every applicable rule, not only the expression that errored. A non-matching Deny is not the final authorization decision.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
