ENG-2194: Add custom default policy configuration support #7323

JadeCara · 2026-02-05T19:22:44Z

Ticket

ENG-2194

Description Of Changes

Custom Default Policy Configuration

Add support for custom default policies per action type via ApplicationConfig. When no policy conditions match a privacy request, the PolicyEvaluator now:

First checks for a custom default policy configured via the API (ApplicationConfig.api_set)
Validates the custom default still exists and has rules for the action type
Falls back to the system default if the custom default is missing or invalid

This enables administrators to override the system default policies (default_access_policy, default_erasure_policy, default_consent_policy) with organization-specific defaults.

Policy Conditions in API Responses

The policy list endpoint now eagerly loads and returns policy conditions in the response. PolicyResponse includes a new conditions field populated via a model validator that extracts the condition tree from the ORM relationship.

Location Groups & Regulations Support

Expanded location convenience field resolution to support location groups (e.g., "us", "ca" as groups, not just individual locations). The MUTUALLY_EXCLUSIVE_FIELDS set now includes location_groups and location_regulations for proper condition tiebreaking.

Code Changes

File	Change
`src/fides/api/task/conditional_dependencies/policy_evaluation.py`	Added `_get_configured_default_policy_key()` method and updated `_get_default_policy()` to check custom defaults first; added `location_groups` and `location_regulations` to `MUTUALLY_EXCLUSIVE_FIELDS`
`src/fides/api/schemas/policy.py`	Added `conditions` field to `PolicyResponse` with `extract_conditions` model validator; modernized type hints (`List` → `list`, `Dict` → `dict`)
`src/fides/api/api/v1/endpoints/policy_endpoints.py`	Added `joinedload(Policy.conditions)` to policy list query for eager loading
`src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py`	Added `location_groups` lookup before country code fallback in convenience field resolution
`src/fides/api/util/default_policy_config.py`	New file with `DEFAULT_POLICY_CONFIG_KEY` constant shared between fides and fidesplus
`tests/api/task/conditional_dependencies/test_policy_evaluation.py`	Added `TestCustomDefaultPolicy` test class (5 tests); expanded `test_routes_by_location` and `test_ambiguous_tie_raises_error` to parameterize over all location field types (location, country, groups, regulations)
`tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_endpoints.py`	Updated expected response assertions to include `"conditions": {}`
`changelog/7323.yaml`	Added changelog entry

Steps to Confirm

Note: This PR provides the fides OSS infrastructure. End-to-end testing requires the companion fidesplus branch (ENG-2194-be-default-policy-configuration-api on fidesplus, PR #3050) which adds the API endpoints. Deploy both branches together to test.

Prerequisites: Create policies with conditions using the policy conditions endpoints from #3031.

Verify policy conditions are returned in the policy list using GET /api/v1/policy
Expected: Each policy includes a conditions field containing its condition tree ({} if no conditions).
Set a custom default policy using PUT /api/v1/plus/dsr/policy/default
{ "action_type": "access", "policy_key": "my_custom_access_policy"}
Expected: 200 response with updated config showing the custom policy key for access.
Verify custom default is used when no conditions match using POST /api/v1/privacy-request
[ { "identity": {"email": "test@example.com"}, "location": "XX", "action_type": "access" }]
Expected: Request created using my_custom_access_policy (not default_access_policy).
Reset to system default using PUT /api/v1/plus/dsr/policy/default
{ "action_type": "access", "policy_key": null}
Expected: 200 response. Subsequent privacy requests with no matching conditions fall back to default_access_policy.
Verify location group matching - Create a policy with a location_groups = eea condition, then POST /api/v1/privacy-request
[ { "identity": {"email": "test@example.com"}, "location": "FR", "action_type": "access" }]
Expected: France resolves to the eea group and matches the policy.
Verify location regulation matching - Create a policy with a location_regulations = gdpr condition, then POST /api/v1/privacy-request
[{"identity": {"email": "test@example.com"}, "location": "FR", "action_type": "access" }]
Expected: France resolves to the gdpr regulation and matches the policy.
Read the current default config using GET /api/v1/plus/dsr/policy/default
Expected: Returns access, erasure, and consent fields (each null for system default or a policy key for custom).

Pre-Merge Checklist

Made with Cursor

Allow configuring custom default policies per action type via ApplicationConfig. Falls back to system defaults if custom default is missing or invalid. Co-authored-by: Cursor <cursoragent@cursor.com>

vercel · 2026-02-05T19:22:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored	Preview	Feb 10, 2026 0:33am
fides-privacy-center	Ignored		Feb 10, 2026 0:33am

Co-authored-by: Cursor <cursoragent@cursor.com>

vercel · 2026-02-09T20:28:33Z

Deployment failed with the following error:

Creating the Deployment Timed Out.

….com:ethyca/fides into ENG-2194-be-default-policy-configuration-api

greptile-apps · 2026-02-09T21:54:26Z

Greptile Overview

Greptile Summary

This PR adds support for custom per-action default policies via ApplicationConfig.api_set, allowing PolicyEvaluator to prefer an administrator-configured default policy when no conditions match and to fall back to system-seeded defaults if the configured key is missing/invalid.

It also extends location convenience-field resolution to support location groups/regulations, updates specificity/tiebreaking to treat those fields as mutually exclusive with other location selectors, and updates the policy list endpoint to eager-load rules (including storage_destination) and conditions so policy responses can include a new conditions field derived from the Policy.conditions relationship.

Main issue to address before merge: the new PolicyResponse.conditions validator currently only handles dict and plain list inputs; if SQLAlchemy provides a non-list collection type, the API will silently return {} even when conditions exist, which breaks the intended API contract for GET /api/v1/policy.

Confidence Score: 4/5

Mostly safe to merge, but there is a correctness risk in how policy conditions are serialized to the API response.
Core behavior changes (custom default selection, location tiering, eager loading) are covered by tests and use defensive config parsing. The remaining concern is PolicyResponse.extract_conditions() relying on isinstance(v, list); if the ORM relationship is not a plain list type, conditions may incorrectly serialize as {} despite DB state, undermining the new API feature.
src/fides/api/schemas/policy.py

Important Files Changed

Filename	Overview
changelog/7323.yaml	Adds changelog entry for custom default policy configuration support.
src/fides/api/api/v1/endpoints/policy_endpoints.py	Eager-loads policy rules/storage destinations and policy conditions for the list endpoint to avoid N+1 queries.
src/fides/api/schemas/policy.py	Adds `conditions` field with a validator extracting condition trees; potential bug if ORM relationship isn't a plain list type, leading to `{}` even when conditions exist.
src/fides/api/task/conditional_dependencies/policy_evaluation.py	Adds ApplicationConfig-based custom default policy lookup with defensive type checks; expands mutually exclusive location fields and tiering.
src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py	Extends location convenience resolution to support location groups and group fallback when extracting country codes.
src/fides/api/util/default_policy_config.py	Introduces shared DEFAULT_POLICY_CONFIG_KEY constant for ApplicationConfig api_set default policies.
tests/api/task/conditional_dependencies/test_policy_evaluation.py	Adds coverage for custom default policies and parameterizes location-based routing/tie-breaking across location/country/groups/regulations.
tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_endpoints.py	Updates privacy request endpoint expectations to include empty policy `conditions` field.

greptile-apps

_{7 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

JadeCara · 2026-02-09T22:11:35Z

@greptile please review

greptile-apps

_{8 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

src/fides/api/api/v1/endpoints/policy_endpoints.py

JadeCara · 2026-02-09T22:52:02Z

@greptile please review

greptile-apps

_{8 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py

src/fides/api/task/conditional_dependencies/policy_evaluation.py

JadeCara · 2026-02-09T23:37:52Z

@greptile please review

greptile-apps

_{8 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/task/conditional_dependencies/policy_evaluation.py

src/fides/api/schemas/policy.py

JadeCara · 2026-02-10T00:17:48Z

@greptile please review

greptile-apps

_{8 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

JadeCara · 2026-02-10T00:32:53Z

@greptile please review

greptile-apps

_{8 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-10T00:38:25Z

src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py

+            location_data = get_location_by_id(country_code) or location_groups.get(
+                country_code
+            )


Wrong type returned

location_groups.get(country_code) can return a LocationGroup (not a Location). Immediately after, this code treats location_data like a Location (location_data.belongs_to, location_data.regulation, location_data.is_country), which will raise AttributeError when the lookup hits a group (e.g., when country_code is a group id like "us"). This will break privacy request evaluation for such inputs.

Also appears at src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py:147-148 (group lookup assigned to location_data).

@greptile LocationGroup inherits from Location, so it has all the same attributes: belongs_to, regulation, and is_country. Accessing those on a LocationGroup instance will not raise AttributeError — it works identically to accessing them on a Location.

greptile-apps · 2026-02-10T00:38:26Z

src/fides/api/schemas/policy.py

+        if isinstance(v, list):
+            # Multiple rows per policy is prevented by the DB unique constraint
+            # `uq_policy_condition_policy_id` on policy_condition.policy_id
+            # (see PolicyCondition model and migration 6d5f70dd0ba5).
+            # We log-and-continue rather than raise so that read endpoints
+            # never 500 on unexpected DB state.
+            if len(v) > 1:
+                logger.warning(
+                    "Policy has %d condition rows; expected at most 1. "
+                    "This indicates data corruption — the unique constraint on "
+                    "policy_id should prevent multiple condition rows. "
+                    "Using the first row.",
+                    len(v),
+                )
+            if hasattr(v[0], "condition_tree") and v[0].condition_tree:
+                return v[0].condition_tree
+        return {}


Conditions silently truncated

When Policy.conditions has multiple rows, extract_conditions() logs a warning and then returns only v[0].condition_tree. If multiple PolicyCondition rows can exist in the DB (legacy/corruption/manual edits), this makes GET /api/v1/policy return a condition tree that can disagree with how policy evaluation actually works (which iterates over all PolicyCondition rows). This should be handled deterministically (e.g., enforce the 1-row invariant at read-time with a clear error payload, or serialize/merge all trees) rather than silently picking the first row.

@greptile There will only be 1 row - there is a unique constraint AND returns one or none.

JadeCara · 2026-02-10T00:44:10Z

@greptile please review and take comments into account

greptile-apps

_{8 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-10T00:46:43Z

src/fides/api/schemas/policy.py

+    @field_validator("conditions", mode="before")
+    @classmethod
+    def extract_conditions(cls, v: Any) -> dict[str, Any]:
+        """Extract the condition tree from the ORM conditions relationship.


Conditions serialization mismatch

PolicyResponse.extract_conditions() only handles dict and list inputs; if the ORM relationship comes through as a SQLAlchemy InstrumentedList/other collection type (not a plain list), this will fall through to return {} even when conditions exist, making GET /api/v1/policy silently omit condition trees. Consider accepting generic sequences (e.g., collections.abc.Sequence) or explicitly handling SQLAlchemy collection types so non-empty relationships always serialize correctly.

add custom default policy configuration support

a72228f

Allow configuring custom default policies per action type via ApplicationConfig. Falls back to system defaults if custom default is missing or invalid. Co-authored-by: Cursor <cursoragent@cursor.com>

Jade Wibbels and others added 3 commits February 5, 2026 12:24

add changelog for PR #7323

082db66

Co-authored-by: Cursor <cursoragent@cursor.com>

update dsr policy endpoints to include conditins

2489c65

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

9674c27

vercel bot had a problem deploying to Preview – fides-plus-nightly February 6, 2026 21:22 Failure

JadeCara added 2 commits February 6, 2026 16:25

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

9e34432

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

6884e50

vercel bot deployed to Preview – fides-plus-nightly February 9, 2026 18:59 View deployment

Jade Wibbels and others added 2 commits February 9, 2026 12:46

test fixes

780c84f

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

d622293

vercel bot deployed to Preview – fides-plus-nightly February 9, 2026 20:25 View deployment

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

86c3769

JadeCara marked this pull request as ready for review February 9, 2026 21:30

JadeCara requested review from a team as code owners February 9, 2026 21:30

Jade Wibbels added 2 commits February 9, 2026 14:31

update for countries listed in groups

6da88b5

Merge branch 'ENG-2194-be-default-policy-configuration-api' of github…

fa5c16a

….com:ethyca/fides into ENG-2194-be-default-policy-configuration-api

vercel bot deployed to Preview – fides-plus-nightly February 9, 2026 21:38 View deployment

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/schemas/policy.py Show resolved Hide resolved

linting

73377ef

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/schemas/policy.py Outdated Show resolved Hide resolved

src/fides/api/schemas/policy.py Outdated Show resolved Hide resolved

src/fides/api/api/v1/endpoints/policy_endpoints.py Show resolved Hide resolved

update for comments

dc8b136

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/schemas/policy.py Outdated Show resolved Hide resolved

src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py Show resolved Hide resolved

src/fides/api/task/conditional_dependencies/policy_evaluation.py Outdated Show resolved Hide resolved

Jade Wibbels added 2 commits February 9, 2026 16:13

updates

34d6c13

fix test

b3ab67b

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/task/conditional_dependencies/policy_evaluation.py Outdated Show resolved Hide resolved

src/fides/api/schemas/policy.py Show resolved Hide resolved

src/fides/api/schemas/policy.py Show resolved Hide resolved

feedback

b3f3c28

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

src/fides/api/schemas/policy.py Show resolved Hide resolved

update with comment

674b343

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

360d04f

JadeCara requested a review from johnewart February 10, 2026 00:37

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

ENG-2194: Add custom default policy configuration support #7323

Are you sure you want to change the base?

ENG-2194: Add custom default policy configuration support #7323

Conversation

JadeCara commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ticket

Description Of Changes

Custom Default Policy Configuration

Policy Conditions in API Responses

Location Groups & Regulations Support

Code Changes

Steps to Confirm

Pre-Merge Checklist

Uh oh!

vercel bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Feb 9, 2026

Uh oh!

greptile-apps bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JadeCara commented Feb 9, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JadeCara commented Feb 9, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JadeCara commented Feb 9, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JadeCara commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JadeCara commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

JadeCara Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

JadeCara Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

JadeCara commented Feb 10, 2026

Uh oh!

JadeCara commented Feb 5, 2026 •

edited

Loading

vercel bot commented Feb 5, 2026 •

edited

Loading

greptile-apps bot commented Feb 9, 2026 •

edited

Loading