diff --git a/policy/tester.go b/policy/tester.go
index 17477f339..b5f3bfaaa 100644
--- a/policy/tester.go
+++ b/policy/tester.go
@@ -600,7 +600,7 @@ func missingInputRefs(mods []*ast.Module, input *Input) []string {
 		return nil
 	}
 	inputMap := normalizeInput(input)
-	refs := collectUnknowns(mods)
+	refs := collectUnknowns(mods, nil)
 	missing := make([]string, 0, len(refs))
 	for _, ref := range refs {
 		key := strings.TrimPrefix(ref, "input.")
diff --git a/policy/validate.go b/policy/validate.go
index 7f3b1b73a..a66b3a6ca 100644
--- a/policy/validate.go
+++ b/policy/validate.go
@@ -223,10 +223,11 @@ func (p *Policy) CheckPolicy(ctx context.Context, req *policysession.CheckPolicy
 		if err != nil {
 			return nil, nil, err
 		}
-		unk := collectUnknowns(pq.Support)
+		unk := collectUnknowns(pq.Support, unknowns)
 		if _, ok := st.Unknowns[funcVerifyGitSignature]; ok {
 			unk = append(unk, "input.git.commit")
 		}
+
 		if len(unk) > 0 {
 			next := &gwpb.ResolveSourceMetaRequest{
 				Source:   req.Source.Source,
@@ -672,7 +673,7 @@ func AddUnknownsWithLogger(logf func(logrus.Level, string), req *gwpb.ResolveSou
 	return nil
 }
 
-func collectUnknowns(mods []*ast.Module) []string {
+func collectUnknowns(mods []*ast.Module, allowed []string) []string {
 	seen := map[string]struct{}{}
 	var out []string
 
@@ -680,6 +681,7 @@ func collectUnknowns(mods []*ast.Module) []string {
 		ast.WalkRefs(mod, func(ref ast.Ref) bool {
 			if ref.HasPrefix(ast.InputRootRef) {
 				s := ref.String() // e.g. "input.request.path"
+				s = "input." + trimKey(strings.TrimPrefix(s, "input."))
 				if _, ok := seen[s]; !ok {
 					seen[s] = struct{}{}
 					out = append(out, s)
@@ -688,7 +690,23 @@ func collectUnknowns(mods []*ast.Module) []string {
 			return true
 		})
 	}
-	return out
+	if allowed == nil {
+		return out
+	}
+
+	valid := map[string]struct{}{}
+	for _, k := range allowed {
+		valid[k] = struct{}{}
+	}
+
+	filtered := make([]string, 0, len(out))
+	for _, k := range out {
+		if _, ok := valid[k]; ok {
+			filtered = append(filtered, k)
+		}
+	}
+
+	return filtered
 }
 
 func summarizeUnknownsForLog(unk []string) []string {