# Harness: Incident updated: Intermittent failures in Policy step evaluations on Prod 7

> Incident updated: Intermittent failures in Policy step evaluations on Prod 7. Detected 2026-11-10 by Rewindex: what changed on Harness’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/r4b5a492b96ce17
Last updated: 2026-11-10T22:23:52Z

**Summary:** _summary pending_
- Kind: Incident update · Label: not classified yet
- Changed: 2026-11-10 22:23 UTC · Detected: 2026-11-10 22:23 UTC
- [Source: https://stspg.io/pfwpb7pvmlf7](https://stspg.io/pfwpb7pvmlf7)
- [Company: Harness](https://rewindex.com/company/harness.md)
- Versions: before incident\_version:695/2366tsdd6fwj@8ec69d1a63f0 → after incident\_version:695/2366tsdd6fwj@e5a5bc727c41
- Change 1 of 1 for this incident

Incident page (full timeline): [Intermittent failures in Policy step evaluations on Prod 7](https://rewindex.com/company/harness/incidents/2366tsdd6fwj.md)
## What changed

**1. Changed: Status**

```diff
- resolved
+ postmortem
```

**2. Added: Update** (postmortem) · 2026-11-10 22:19 UTC

```diff
+ Summary Policy evaluation for a pipeline step intermittently failed for one customer with an "unsupported principal type for internal token" error once an enhanced tenant-isolation safeguard was turned on. Root cause Our internal services authenticate to each other using signed internal tokens. The service that evaluates policy only accepts tokens whose principal is marked as one of a small set of recognized types; a token with a missing or unrecognized principal type is rejected. The affected pipeline step was missing a safeguard that other callers rely on to guarantee their internal token always carries a recognized principal type. As a result, under certain conditions it could present a token with an unsupported principal type to the policy service, causing the request to be rejected. ‌ Mitigation We mitigated the immediate impact by disabling the safeguard. Remediation We are applying the fix at the shared client layer used by every caller of the policy evaluation service, including the affected pipeline step, OPA helper utilities, secrets, and connectors, so the fix protects all current and future callers consistently. Tokens with a recognized principal type continue to be forwarded as-is. Tokens with a missing or unsupported principal type will instead be re-signed as the calling service. Next steps We are rolling out the fix gradually, starting in shadow mode, with additional logging and observability added across all call paths so we can confirm the fix covers every use case, including lower-traffic ones, before it is enabled broadly.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-11-10 22:23 UTC | Incident updated: Intermittent failures in Policy step evaluations on Prod 7 (this change) |  |

All Harness changes: [timeline](https://rewindex.com/company/harness/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._

## Cite this

Incident updated: Intermittent failures in Policy step evaluations on Prod 7 on Harness’s status page, changed 2026-11-10 22:23 UTC (change 1 of 1).

- Canonical URL: https://rewindex.com/change/r4b5a492b96ce17
- Citation: Harness, “Incident updated: Intermittent failures in Policy step evaluations on Prod 7” (2026-11-10 22:23 UTC). Archived by Rewindex: https://rewindex.com/change/r4b5a492b96ce17 (CC BY 4.0).
- Markdown link: `[Harness: Incident updated: Intermittent failures in Policy step evaluations on Prod 7 (2026-11-10)](https://rewindex.com/change/r4b5a492b96ce17)`


---
Canonical: https://rewindex.com/change/r4b5a492b96ce17 · Markdown: https://rewindex.com/change/r4b5a492b96ce17.md · JSON: https://rewindex.com/api/v1/changes/r4b5a492b96ce17 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T04:21:59.426Z