where path resolves to a Hash value whose key you're looking up. The allowable path}}s are {{trusted. and facts. (so anything in the trusted or facts hash). All other paths will raise an error. This is to prevent people from using (unsafe) top-scope variables to get Hiera data (bad practice). However, we will still support unsafe access via an unsafe option. Configuring that would look something like