Skip to content

Tenant Policy Subset Violation

URI: https://docs.ankatech.co/errors/tenant-policy-subset-violation
HTTP Status: 422 Unprocessable Entity

When you see this

The policy you tried to set is not a subset of the parent (platform or tenant-type) policy. A tenant policy may only narrow — never widen — the policy it inherits from.

Common Causes

  • Adding an algorithm or capability to a tenant policy that the parent policy does not allow.
  • Loosening a restriction beyond what the inherited policy permits.
  • Defining a policy value outside the bounds of the parent policy.

Response Example

{
  "type": "https://docs.ankatech.co/errors/tenant-policy-subset-violation",
  "title": "Tenant Policy Subset Violation",
  "status": 422,
  "detail": "Tenant algorithm policy violates deployment subset constraint on 2 dimensions: allowedFamilies has 1 value(s) not in deployment; allowedLevels has 1 value(s) not in deployment",
  "instance": "/api/v3/admin/tenants/3f9a1b62-5d47-4c8e-b0a2-91d7e4f60cc5/policies/algorithm-availability",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000",
    "policyType": "algorithm",
    "violations": [
      { "dimension": "allowedFamilies", "extraValues": ["RSA"] },
      { "dimension": "allowedLevels", "extraValues": ["*"] }
    ]
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

Extension members: policyType names the tenant policy type that was refused; violations carries one entry per offending dimension, and each extraValues lists only the values the tenant policy admits that the deployment policy does not — never the deployment policy itself. extraValues: ["*"] means the tenant left that dimension empty under a deployment policy that restricts it: an empty tenant dimension means "everything", which is wider than any restriction.

How to Resolve

  1. Review the parent (platform/tenant-type) policy to see the allowed bounds.
  2. Adjust the tenant policy so it only narrows the inherited policy.
  3. Remove every value named in extensions.violations[].extraValues and re-submit; where the entry is ["*"], give that dimension an explicit value inside the parent's set instead of leaving it empty.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.