The default filter only replaces undefined values unless its boolean flag is enabled. An entry with 'filename: ""' - as documented in defaults/main.yaml - therefore produced a sudoers drop-in file without a name. Enabling the flag makes the role fall back to the user or group name for empty filenames as well. Co-authored-by: Copilot <copilot@github.com>