ENG-2194: Add custom default policy configuration support by JadeCara · Pull Request #7323 · ethyca/fides

JadeCara · 2026-02-05T19:22:44Z

Ticket

ENG-2194

Description Of Changes

Custom Default Policy Configuration

Add support for custom default policies per action type via ApplicationConfig. When no policy conditions match a privacy request, the PolicyEvaluator now:

First checks for a custom default policy configured via the API (ApplicationConfig.api_set)
Validates the custom default still exists and has rules for the action type
Falls back to the system default if the custom default is missing or invalid

This enables administrators to override the system default policies (default_access_policy, default_erasure_policy, default_consent_policy) with organization-specific defaults.

Policy Conditions in API Responses

The policy list endpoint now eagerly loads and returns policy conditions in the response. PolicyResponse includes a new conditions field populated via a model validator that extracts the condition tree from the ORM relationship.

Location Groups & Regulations Support

Expanded location convenience field resolution to support location groups (e.g., "us", "ca" as groups, not just individual locations). The MUTUALLY_EXCLUSIVE_FIELDS set now includes location_groups and location_regulations for proper condition tiebreaking.

Code Changes

File	Change
`src/fides/api/task/conditional_dependencies/policy_evaluation.py`	Added `_get_configured_default_policy_key()` method and updated `_get_default_policy()` to check custom defaults first; added `location_groups` and `location_regulations` to `MUTUALLY_EXCLUSIVE_FIELDS`
`src/fides/api/schemas/policy.py`	Added `conditions` field to `PolicyResponse` with `extract_conditions` model validator; modernized type hints (`List` → `list`, `Dict` → `dict`)
`src/fides/api/api/v1/endpoints/policy_endpoints.py`	Added `joinedload(Policy.conditions)` to policy list query for eager loading
`src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py`	Added `location_groups` lookup before country code fallback in convenience field resolution
`src/fides/api/util/default_policy_config.py`	New file with `DEFAULT_POLICY_CONFIG_KEY` constant shared between fides and fidesplus
`tests/api/task/conditional_dependencies/test_policy_evaluation.py`	Added `TestCustomDefaultPolicy` test class (5 tests); expanded `test_routes_by_location` and `test_ambiguous_tie_raises_error` to parameterize over all location field types (location, country, groups, regulations)
`tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_endpoints.py`	Updated expected response assertions to include `"conditions": {}`
`changelog/7323.yaml`	Added changelog entry

Steps to Confirm

Note: This PR provides the fides OSS infrastructure. End-to-end testing requires the companion fidesplus branch (ENG-2194-be-default-policy-configuration-api on fidesplus, PR #3050) which adds the API endpoints. Deploy both branches together to test.

Prerequisites: Create policies with conditions using the policy conditions endpoints from #3031.

Verify policy conditions are returned in the policy list using GET /api/v1/dsr/policy
Expected: Each policy includes a conditions field containing its condition tree ({} if no conditions).
Set a custom default policy using PUT /api/v1/plus/dsr/policy/default
{ "action_type": "access", "policy_key": "my_custom_access_policy"}
Expected: 200 response with updated config showing the custom policy key for access.
Verify custom default is used when no conditions match using POST /api/v1/privacy-request
[ { "identity": {"email": "test@example.com"}, "location": "XX", "action_type": "access" }]
Expected: Request created using my_custom_access_policy (not default_access_policy).
Reset to system default using PUT /api/v1/plus/dsr/policy/default
{ "action_type": "access", "policy_key": null}
Expected: 200 response. Subsequent privacy requests with no matching conditions fall back to default_access_policy.
Verify location group matching - Create a policy with a location_groups = eea condition, then POST /api/v1/privacy-request
[ { "identity": {"email": "test@example.com"}, "location": "FR", "action_type": "access" }]
Expected: France resolves to the eea group and matches the policy.
Verify location regulation matching - Create a policy with a location_regulations = gdpr condition, then POST /api/v1/privacy-request
[{"identity": {"email": "test@example.com"}, "location": "FR", "action_type": "access" }]
Expected: France resolves to the gdpr regulation and matches the policy.
Read the current default config using GET /api/v1/plus/dsr/policy/default
Expected: Returns access, erasure, and consent fields (each null for system default or a policy key for custom).

Pre-Merge Checklist

Made with Cursor

Allow configuring custom default policies per action type via ApplicationConfig. Falls back to system defaults if custom default is missing or invalid. Co-authored-by: Cursor <cursoragent@cursor.com>

vercel · 2026-02-05T19:22:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ready	Preview, Comment	Feb 12, 2026 7:28pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
fides-privacy-center	Ignored		Feb 12, 2026 7:28pm

Co-authored-by: Cursor <cursoragent@cursor.com>

vercel · 2026-02-09T20:28:33Z

Deployment failed with the following error:

Creating the Deployment Timed Out.

….com:ethyca/fides into ENG-2194-be-default-policy-configuration-api

greptile-apps · 2026-02-09T21:54:26Z

Greptile Overview

Greptile Summary

This PR adds support for custom per-action default policies via ApplicationConfig.api_set, allowing PolicyEvaluator to prefer an administrator-configured default policy when no conditions match and to fall back to system-seeded defaults if the configured key is missing/invalid.

It also extends location convenience-field resolution to support location groups/regulations, updates specificity/tiebreaking to treat those fields as mutually exclusive with other location selectors, and updates the policy list endpoint to eager-load rules (including storage_destination) and conditions so policy responses can include a new conditions field derived from the Policy.conditions relationship.

Main issue to address before merge: the new PolicyResponse.conditions validator currently only handles dict and plain list inputs; if SQLAlchemy provides a non-list collection type, the API will silently return {} even when conditions exist, which breaks the intended API contract for GET /api/v1/policy.

Confidence Score: 4/5

Mostly safe to merge, but there is a correctness risk in how policy conditions are serialized to the API response.
Core behavior changes (custom default selection, location tiering, eager loading) are covered by tests and use defensive config parsing. The remaining concern is PolicyResponse.extract_conditions() relying on isinstance(v, list); if the ORM relationship is not a plain list type, conditions may incorrectly serialize as {} despite DB state, undermining the new API feature.
src/fides/api/schemas/policy.py

Important Files Changed

Filename	Overview
changelog/7323.yaml	Adds changelog entry for custom default policy configuration support.
src/fides/api/api/v1/endpoints/policy_endpoints.py	Eager-loads policy rules/storage destinations and policy conditions for the list endpoint to avoid N+1 queries.
src/fides/api/schemas/policy.py	Adds `conditions` field with a validator extracting condition trees; potential bug if ORM relationship isn't a plain list type, leading to `{}` even when conditions exist.
src/fides/api/task/conditional_dependencies/policy_evaluation.py	Adds ApplicationConfig-based custom default policy lookup with defensive type checks; expands mutually exclusive location fields and tiering.
src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py	Extends location convenience resolution to support location groups and group fallback when extracting country codes.
src/fides/api/util/default_policy_config.py	Introduces shared DEFAULT_POLICY_CONFIG_KEY constant for ApplicationConfig api_set default policies.
tests/api/task/conditional_dependencies/test_policy_evaluation.py	Adds coverage for custom default policies and parameterizes location-based routing/tie-breaking across location/country/groups/regulations.
tests/ops/api/v1/endpoints/privacy_request/test_privacy_request_endpoints.py	Updates privacy request endpoint expectations to include empty policy `conditions` field.

greptile-apps

_{7 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

JadeCara · 2026-02-09T22:11:35Z

@greptile please review

greptile-apps

_{8 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

src/fides/api/api/v1/endpoints/policy_endpoints.py

JadeCara · 2026-02-09T22:52:02Z

@greptile please review

greptile-apps

_{8 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py

src/fides/api/task/conditional_dependencies/policy_evaluation.py

JadeCara · 2026-02-09T23:37:52Z

@greptile please review

greptile-apps

_{8 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/task/conditional_dependencies/policy_evaluation.py

src/fides/api/schemas/policy.py

JadeCara · 2026-02-10T00:17:48Z

@greptile please review

greptile-apps

_{8 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

JadeCara · 2026-02-10T00:32:53Z

@greptile please review

greptile-apps

_{8 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py

src/fides/api/schemas/policy.py

JadeCara · 2026-02-10T00:44:10Z

@greptile please review and take comments into account

greptile-apps

_{8 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

src/fides/api/schemas/policy.py

johnewart

Looks good - the questions I had we talked about out-of-band 👍

add custom default policy configuration support

a72228f

Allow configuring custom default policies per action type via ApplicationConfig. Falls back to system defaults if custom default is missing or invalid. Co-authored-by: Cursor <cursoragent@cursor.com>

Jade Wibbels and others added 3 commits February 5, 2026 12:24

add changelog for PR #7323

082db66

Co-authored-by: Cursor <cursoragent@cursor.com>

update dsr policy endpoints to include conditins

2489c65

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

9674c27

vercel bot had a problem deploying to Preview – fides-plus-nightly February 6, 2026 21:22 Failure

JadeCara added 2 commits February 6, 2026 16:25

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

9e34432

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

6884e50

vercel bot deployed to Preview – fides-plus-nightly February 9, 2026 18:59 View deployment

Jade Wibbels and others added 2 commits February 9, 2026 12:46

test fixes

780c84f

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

d622293

vercel bot deployed to Preview – fides-plus-nightly February 9, 2026 20:25 View deployment

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

86c3769

JadeCara marked this pull request as ready for review February 9, 2026 21:30

JadeCara requested review from a team as code owners February 9, 2026 21:30

Jade Wibbels added 2 commits February 9, 2026 14:31

update for countries listed in groups

6da88b5

Merge branch 'ENG-2194-be-default-policy-configuration-api' of github…

fa5c16a

….com:ethyca/fides into ENG-2194-be-default-policy-configuration-api

vercel bot deployed to Preview – fides-plus-nightly February 9, 2026 21:38 View deployment

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/schemas/policy.py Show resolved Hide resolved

linting

73377ef

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/schemas/policy.py Outdated Show resolved Hide resolved

src/fides/api/schemas/policy.py Outdated Show resolved Hide resolved

src/fides/api/api/v1/endpoints/policy_endpoints.py Show resolved Hide resolved

update for comments

dc8b136

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/schemas/policy.py Outdated Show resolved Hide resolved

src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py Show resolved Hide resolved

src/fides/api/task/conditional_dependencies/policy_evaluation.py Outdated Show resolved Hide resolved

Jade Wibbels added 2 commits February 9, 2026 16:13

updates

34d6c13

fix test

b3ab67b

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/fides/api/task/conditional_dependencies/policy_evaluation.py Outdated Show resolved Hide resolved

src/fides/api/schemas/policy.py Show resolved Hide resolved

src/fides/api/schemas/policy.py Show resolved Hide resolved

feedback

b3f3c28

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

src/fides/api/schemas/policy.py Show resolved Hide resolved

update with comment

674b343

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

360d04f

JadeCara requested a review from johnewart February 10, 2026 00:37

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

src/fides/api/task/conditional_dependencies/privacy_request/convenience_fields.py Show resolved Hide resolved

src/fides/api/schemas/policy.py Show resolved Hide resolved

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

src/fides/api/schemas/policy.py Show resolved Hide resolved

Jade Wibbels and others added 3 commits February 10, 2026 09:11

add PrivacyRequest prototype

7ebfff6

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

d8d5e46

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

53cff42

vercel bot deployed to Preview – fides-plus-nightly February 10, 2026 18:28 View deployment

Jade Wibbels and others added 2 commits February 11, 2026 17:46

update info for convenience fields

c7cc70d

Merge branch 'main' into ENG-2194-be-default-policy-configuration-api

2306d40

vercel bot deployed to Preview – fides-plus-nightly February 12, 2026 19:28 View deployment

johnewart approved these changes Feb 12, 2026

View reviewed changes

JadeCara added this pull request to the merge queue Feb 12, 2026

Merged via the queue into main with commit 7d9a0cc Feb 12, 2026
54 checks passed

JadeCara deleted the ENG-2194-be-default-policy-configuration-api branch February 12, 2026 23:06

Conversation

JadeCara commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ticket

Description Of Changes

Custom Default Policy Configuration

Policy Conditions in API Responses

Location Groups & Regulations Support

Code Changes

Steps to Confirm

Pre-Merge Checklist

Uh oh!

vercel bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Feb 9, 2026

Uh oh!

greptile-apps bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JadeCara commented Feb 9, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JadeCara commented Feb 9, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JadeCara commented Feb 9, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JadeCara commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JadeCara commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

JadeCara commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

johnewart left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

JadeCara commented Feb 5, 2026 •

edited

Loading

vercel bot commented Feb 5, 2026 •

edited

Loading

greptile-apps bot commented Feb 9, 2026 •

edited

Loading