Error message
In the message, %s marks a value that the engine fills in when it raises the error.
The story
Your manifest grants permission to someone who is not a node. Let's see who can be granted anything. In rush, permission is always to nodes, from computer to computer. In the manifest you write a perm list in the config call, and every item is a node ID: exactly sixty-four lowercase hexadecimal digits, the same segment that the rush identity command prints for this machine. What gets refused? A bare word. A number. A map. A list that never closes. And any item that is not sixty-four lowercase hex digits: a full dotted uid chain, a person's name, a digest that is too short, or one written in capitals. Rush refuses before it parses any source file, and it will not guess what you meant, since a grant that is quietly reinterpreted becomes a grant to the wrong party. The first slot shows the manifest, the line, the item, and what it is instead. The fix is to run rush identity on the machine you want to grant, copy its node ID exactly, and put it in quotes in your perm list.
Text from the Rush engine's error catalogue.