feat: Policy conflict resolution with 4 declared strategies#97
Merged
imran-siddique merged 1 commit intomainfrom Mar 7, 2026
Merged
feat: Policy conflict resolution with 4 declared strategies#97imran-siddique merged 1 commit intomainfrom
imran-siddique merged 1 commit intomainfrom
Conversation
- Add ConflictResolutionStrategy enum: DENY_OVERRIDES, ALLOW_OVERRIDES, PRIORITY_FIRST_MATCH, MOST_SPECIFIC_WINS - Add PolicyScope enum: GLOBAL, TENANT, AGENT with specificity ranking - Add PolicyConflictResolver with resolution trace for auditability - Add 'scope' field to Policy model (defaults to 'global') - Wire conflict resolution into PolicyEngine.evaluate() — collects ALL matching rules then resolves via configured strategy - Default strategy is PRIORITY_FIRST_MATCH (backward compatible with v1.0) - 25 tests covering all 4 strategies, edge cases, and engine integration - 54 existing policy tests continue to pass (Closes #91) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #91 — Declares an explicit, documented, and testable conflict resolution model for the policy engine.
Problem
When multiple policies apply to the same agent action, the existing engine uses implicit priority-based first-match-wins with no declared precedence model. This is the hardest unsolved problem in every policy engine (XACML, OPA, Cedar) and was entirely undocumented.
Solution
*New module: \conflict_resolution.py*
4 conflict resolution strategies:
Policy scope field:
Resolution trace:
Breaking Changes
None. Default strategy is \PRIORITY_FIRST_MATCH\ which preserves v1.0 behavior. The \scope\ field defaults to \global.
Tests