Skip to content

Z616: CROSS_NAMESPACE_LINK_FORBIDDEN

  • Severity: Error

    Penalty: 0.0 points | Category: general

  • Remediation & Opt-In

    Auto-Fixable: No | Opt-In: No

Description

An internal link originates from a restricted source namespace and resolves to a forbidden target namespace in the Virtual Site Map (VSM).

The Policy-as-Code Engine leverages the Virtual Site Map (VSM) and in-memory path resolution (InMemoryPathResolver) to enforce topological boundaries within the documentation tree. For example, public documentation in /docs/public must never contain links pointing to internal documentation in /docs/internal.

Z616 is an error severity finding (Penalty: 8.0 pts) because cross-namespace link leakage exposes confidential or unreleased internal documentation to public readers.

How to Fix

Remove the link targeting the restricted namespace, or move the target document into an accessible public namespace:

Before (non-compliant when cross_namespace_restrictions = {"docs/public": ["docs/internal"]}):

<!-- File: docs/public/guide.md -->
For internal details, see [Secret Spec](../internal/secret.md).

After (compliant):

<!-- File: docs/public/guide.md -->
For further details, consult the public documentation index.

Configuration

Z616 is opt-in and inactive by default. It is enabled by defining source-to-target boundary mappings under [policies].cross_namespace_restrictions in .zenzic.toml:

[policies.cross_namespace_restrictions]
"docs/public" = ["docs/internal", "docs/confidential"]

When cross_namespace_restrictions is empty or absent, no Z616 findings are emitted.

Suppression

If a cross-namespace link is intentionally required in a specific document, suppress the finding inline:

<!-- zenzic:ignore:Z616 -->
[Internal Secret Spec](../internal/secret.md)

Or use [governance].per_file_ignores in .zenzic.toml:

[governance.per_file_ignores]
"docs/public/admin.md" = ["Z616"]

Reference

See the Finding Codes Index for finding code details.