# "child policies must be subset of parent" when creating a new token

**URL:** <https://discuss.hashicorp.com/t/child-policies-must-be-subset-of-parent-when-creating-a-new-token/72977>\
**Category:** Vault\
**Tags:** vault\
**Created:** [February 2, 2025, 4:39am UTC](https://discuss.hashicorp.com/t/child-policies-must-be-subset-of-parent-when-creating-a-new-token/72977 "2025-02-02T04:39:35Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![y2kbug](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/y2kbug/32/44174_2.png) [@y2kbug](https://discuss.hashicorp.com/u/y2kbug)\
**Post date:** [February 2, 2025, 5:14am UTC](https://discuss.hashicorp.com/t/child-policies-must-be-subset-of-parent-when-creating-a-new-token/72977/2 "2025-02-02T05:14:18Z")

</div>

It seems I have solved the issue.

Referring to this post:

> [@Non root token that can create new tokens with newly created policy](https://discuss.hashicorp.com/t/non-root-token-that-can-create-new-tokens-with-newly-created-policy/51349/3):
>
> From the link above: A list of policies for the token. This must be a subset of the policies belonging to the token making the request, unless the calling token is root or contains sudo capabilities to auth/token/create . Does the token being used to create the restricted token have the same policy linked to it? I don’t mean the same capabilities because obviously it has more capabilites, I mean the actual policy.

> **[Policies | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/docs/concepts/policies#root-protected-api-endpoints)**
>
> Policies are how authorization is done in Vault, allowing you to restrict which parts of Vault a user can access.

I have added `sudo` to the parent policy:

```auto
path "auth/token/create" {
  capabilities = ["sudo","create", "update"]
}

```

And using `-no-default-policy -orphan` in `token create`:

```auto
vault token create -no-default-policy -orphan -policy=${REPO_NAME} -format=json

```

---

_[View the full topic](https://discuss.hashicorp.com/t/child-policies-must-be-subset-of-parent-when-creating-a-new-token/72977)._