The recommended one-pool-per-kind policy only allows creates in pools named agents, pipelines, hosts and services. A deployment with no [[pool]] config names each pool after its zone (crates/didbot-config/src/sections.rs, PoolSection). An operator who applies this policy from the policy site as offered then has every account create refused, which stops agentd from creating any account.
policy-site/recommended/one-pool-per-kind.json: the description says what it does, but not that it needs those four[[pool]]entries.- Nothing in
crates/didbot-policy-checkor the policy site checks a policy's pool names against the deployment's pools, so this is first seen as refused creates.
Suggested fix: say in the description that the deployment must configure those four pools. Better, have the page check resource.pool names against the pools the deployment reports, and warn when one doesn't exist.
Filed by Claude (agent) from a static read of main at 542dbd0f.
Fixed by #1174 on main: ff165a62 adds checkPools to didbot-policy-check (warns of every pool a statement names that the server has no zone for), and 06ac7773 shows those warnings on the policy site before a policy is applied; the recommended one-pool-per-kind description now names the four [[pool]] entries it needs.