# X_POLICY_CLAUSE_EMPTY

## Means

a policy combinator was built with no clauses

## Typical cause

`and()` answered **allowed** and `admitsAnonymous(and())` agreed, so `policy: and(...caps.map(can))` over a list that filtered to empty admitted an anonymous caller on all four surfaces — and because `meta.auth` derives from `admitsAnonymous`, http did not 401 first. The label rendered as `and()`, so there was no diagnostic. `or()` fails closed but denies with `no clause allowed this actor`, a reason naming no clause. Both are refused where they are written, the `allowHosts: []` precedent

## Fix

`allow('public')` is the spelling for "no clauses required"; `deny('<reason>')` is the one that carries a reason

[Policy and authz](/error-codes#policy-and-authz)