fides-pbac standalone CLI and demo fixtures (reference, not for merge)

[galvana]

Reference-only. Not intended for merge. Built on top of policy-engine-go-library to illustrate the shape a standalone fides-pbac CLI could take, and the fixture directory layout it would consume.

What this adds

A single Go binary (fides-pbac) that:

• reads a directory of YAML fixtures (consumers/, purposes/, datasets/, policies/)
• extracts table references from raw SQL
• runs each statement through identity resolution, dataset resolution, purpose evaluation, gap reclassification, and access-policy filtering
• emits JSON that mirrors EvaluationRecord from src/fides/service/pbac/types.py

No Python runtime, no server, no Redis, no database. ~3 ms median startup+config-load. 3.5 MB static binary.

Static fixture files (pbac/ at the repo root)

pbac/
├── README.md                     Cast, scenarios, schema notes
├── consumers/                    One YAML per consumer (top-level: consumer:)
│   ├── analytics-team.yml        alice, priya -> [analytics]
│   ├── marketing-team.yml        bob, maria   -> [marketing]
│   └── onboarding-unconfigured.yml  dave -> []  (for UNCONFIGURED_CONSUMER gap)
├── purposes/                     One YAML per purpose (top-level: purpose:)
│   ├── analytics.yml             analytics.reporting
│   ├── billing.yml               essential.service.payment_processing
│   └── marketing.yml             marketing.advertising
├── datasets/                     Standard fideslang Dataset YAML (top-level: dataset:)
│   ├── sales.yml                 billing at dataset, analytics at collection `invoices`
│   ├── events.yml                analytics
│   └── campaigns.yml             marketing
├── policies/                     One YAML per access policy (top-level: policy:)
│   └── allow-analytics-on-billing-data.yml
│                                 ALLOW on data_use essential.service.payment_processing
└── entries/                      One .txt per identity; SQL separated by ;
    ├── alice.txt                 compliant / suppressed / compliant / violation
    ├── bob.txt                   UNCONFIGURED_DATASET
    ├── carol.txt                 UNRESOLVED_IDENTITY
    └── dave.txt                  UNCONFIGURED_CONSUMER

Fixture schema conventions

Consumer — four fields: name, description, members (list of emails), purposes. Identity resolution is "does --identity appear in some consumer's members list."

Purpose — mirrors fidesplus/seed/pbac/data.py::PURPOSES: fides_key, name, data_use, optional data_subject, data_categories, description.

Dataset — standard fideslang. data_purposes can be declared at the dataset, collection, and field levels; effective purposes for a query on <dataset>.<collection> stack additively:

effective = dataset.data_purposes
          ∪ collection.data_purposes
          ∪ union(field.data_purposes for each field in the collection)

sales.invoices is the live demonstration: dataset is billing, collection adds analytics, so analytics-team queries against invoices pass the purpose check directly without a policy override.

Policy — matches pbac.AccessPolicy. Disabled policies (enabled: false) are filtered out at load time.

Dataset resolution

Collection names are assumed globally unique across datasets, so queries resolve by bare table name regardless of catalog/schema prefix. SELECT FROM orders and SELECT FROM archive.legacy_sales.orders both resolve to the dataset that declares an orders collection. Unknown tables fall through to their qualified name as the identifier on the resulting UNCONFIGURED_DATASET gap.

fides-pbac CLI options

fides-pbac --config DIR --identity EMAIL [FILE]

Flag	Required	Description
--config DIR	yes	Directory containing consumers/, purposes/, datasets/, policies/ YAML subdirectories
--identity EMAIL	yes	User identity to attribute every query in the input to
FILE (positional)	no	SQL input file. Omit or pass - to read from stdin

Statements are split on top-level ; (respecting single-quoted strings, -- line comments, and /* */ block comments). Each statement becomes one record in the output.

Evaluation pipeline (per statement)

1. Table extraction — pkg/sqlextract pulls 1-3 part qualified identifiers from the SQL.
2. Identity resolution — --identity looked up against consumers/ by member email.
3. Dataset resolution — each extracted table looked up against the collection-name index built from collections[].name. Unknown tables fall through to their qualified name.
4. Purpose evaluation — consumer purposes intersected with the effective purposes at (dataset, collection); empty intersection is a PurposeViolation, missing configuration is an EvaluationGap.
5. Gap reclassification — UNRESOLVED_IDENTITY becomes UNCONFIGURED_CONSUMER when the consumer exists but declares no purposes.
6. Policy filtering — each violation's dataset purposes are mapped to data_use strings (via purposes/), then evaluated against policies/. An ALLOW sets suppressed_by_policy (and suppressed_by_action when the policy has an action.message) on the violation in place.

Gaps do not flow through policy filtering. A record is compliant when every violation is suppressed and no gaps were recorded.

Output

JSON on stdout. One records array with:

• query_id, identity, consumer, dataset_keys
• is_compliant
• violations — each PurposeViolation with consumer_id/name, dataset_key, collection, consumer_purposes, dataset_purposes, reason, and the optional suppressed_by_policy / suppressed_by_action inline when an ALLOW policy matched
• gaps, total_accesses, query_text

Mirrors EvaluationRecord from src/fides/service/pbac/types.py with three deliberate deltas: simplified consumer (name string instead of full entity), no timestamp (not available in SQL text), and the inline suppressed_by_policy / suppressed_by_action fields on PurposeViolation.

Install (local checkout)

cd policy-engine
go install ./cmd/fides-pbac

Expected outcomes from the fixture set

Invocation	Outcome
fides-pbac --config pbac/ --identity alice@demo.example pbac/entries/alice.txt	4 records: compliant, suppressed violation, compliant via collection, violation stands
fides-pbac --config pbac/ --identity bob@demo.example pbac/entries/bob.txt	gap unconfigured_dataset identified as cold_storage
fides-pbac --config pbac/ --identity carol@demo.example pbac/entries/carol.txt	gap unresolved_identity
fides-pbac --config pbac/ --identity dave@demo.example pbac/entries/dave.txt	gap unconfigured_consumer

Package additions under policy-engine/

• cmd/fides-pbac/ — CLI entrypoint
• pkg/sqlextract/ — regex-based SQL table extractor + StripComments helper, 31 subtests
• pkg/fixtures/ — YAML loaders returning typed structs consumable by pkg/pbac

Minimal changes to pkg/pbac

• yaml: tags added alongside existing json: tags on AccessPolicy and its nested types. Non-breaking.
• PurposeViolation.SuppressedByPolicy and SuppressedByAction added next to the existing service-enriched fields (DataUse, Control). Optional; absent when the violation wasn't suppressed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored		Apr 15, 2026 10:29pm
fides-privacy-center	Ignored		Apr 15, 2026 10:29pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.41%. Comparing base (59dc9c8) to head (1d27def).

❌ Your project check has failed because the head coverage (83.41%) is below the target coverage (85.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@                     Coverage Diff                      @@
##           policy-engine-go-library    #7941      +/-   ##
============================================================
- Coverage                     85.09%   83.41%   -1.69%     
============================================================
  Files                           631      631              
  Lines                         41053    41052       -1     
  Branches                       4781     4781              
============================================================
- Hits                          34933    34242     -691     
- Misses                         5040     5627     +587     
- Partials                       1080     1183     +103     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.