Explain why a Rego query is undefined
rego_explain_undefinedIdentify which rule condition prevents a Rego query from returning a value by combining evaluation traces and per-condition AST inspection.
Instructions
Diagnose why a fully-qualified Rego query (e.g. "data.authz.allow") produces no value. Combines a plain eval, a full-trace eval, and per-condition AST analysis to identify the exact body expression blocking each rule. Handles both runtime failures (trace-based) and indexer elimination (standalone condition eval). Returns a structured breakdown of which conditions blocked each rule plus a human-readable summary.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Fully-qualified rule reference to explain, e.g. "data.authz.allow". Must match the path you would pass to rego_eval. | |
| source | No | Inline Rego source to analyse. Mutually exclusive with paths. | |
| paths | No | Policy .rego file paths to load. Mutually exclusive with source. | |
| input | No | Input document (JSON value) for the query. | |
| inputPath | No | Path to an input JSON file. |