litellm/tests/test_litellm/proxy/policy_engine
devin-ai-integration[bot] 320ad73f56
fix(policy_engine): keep inherited parent guardrails when a child policy condition misses (#42548)
* fix(policy_engine): keep inherited parent guardrails when a child policy condition misses

Attachment applicability now walks the policy inheritance chain, so an attached child whose own condition does not match still contributes the guardrails of its unconditional ancestors, and a non-default attachment that applies through an ancestor still suppresses default attachments. The resolver continues to skip only the chain members whose own condition fails

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(policy_engine): skip a policy's pipeline when its own condition misses

resolve_pipelines_for_context returned the pipeline of a matched policy without evaluating its own condition, so a condition-missing child admitted by the chain-aware matcher still ran its pipeline. It now mirrors resolve_policy_guardrails and drops the pipeline when the policy's own condition does not match.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test(policy_engine): property test that chain matching only widens to applicable ancestors

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat(policy_engine): log policies admitted only through an inherited ancestor

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(policy_engine): log ancestor admissions once per attachment scan

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: yucheng <yucheng@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-22 23:27:38 -07:00
..
__init__.py [Feat] New LiteLLM Policy engine - create policies to manage guardrails, conditions - permissions per Key, Team (#19612) 2026-01-22 19:49:53 -08:00
test_attachment_registry.py fix(policy_engine): ignore inapplicable non-default attachments when selecting defaults 2026-09-20 09:07:08 +00:00
test_condition_evaluator.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_pipeline_executor.py fix(guardrails): keep the undeliverable rewrite reason through copies and name the responses mismatch 2026-09-19 18:00:03 -07:00
test_policy_engine_endpoints.py fix(policy_engine): decide config policy suppression from fresh db query only 2026-07-30 16:01:57 -07:00
test_policy_matcher.py fix(policy_engine): keep inherited parent guardrails when a child policy condition misses (#42548) 2026-09-22 23:27:38 -07:00
test_policy_resolver.py fix(policy_engine): keep inherited parent guardrails when a child policy condition misses (#42548) 2026-09-22 23:27:38 -07:00
test_policy_validator.py fix(policies): reject non-existent team/key/model scope entries on attachment create (#32131) 2026-07-04 11:58:29 -07:00
test_policy_versioning.py test: require a match= on broad pytest.raises, and drop duplicate parametrize cases (#37769) 2026-08-20 20:24:49 -07:00
test_policy_versioning_e2e.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_response_retrieval.py fix(proxy): type the new pipeline tests and keep tag values out of the deferral warning 2026-09-08 19:59:09 -07:00