fix(field-access-report): reference policy default in denial reason for root fields without explicit rule\n\n- Denied root fields now reference the policy default and its condition in the reason string when no explicit rule is found.\n- Fixes test failure for introspection control policies.\n- Ensures compliance with expected report output and improves clarity for denied access cases.

Author: carloseberhardt

src/services/fieldAccessReport.ts

@@ -174,8 +174,12 @@ export async function generateFieldAccessReportData(
           } else {
             // No rule found, deny by default
             access = "denied";
-            condition = "false";
-            reason = `No rule found for field ${field.name} in policy for root type ${typeName}: denied by default`;
+            condition = policy && policy.policyDefault ? policy.policyDefault.condition : "false";
+            if (policy && policy.policyDefault) {
+              reason = `Policy default: denied (condition: ${policy.policyDefault.condition})`;
+            } else {
+              reason = `No rule found for field ${field.name} in policy for root type ${typeName}: denied by default`;
+            }
           }
         }
       }