ENG-3140: PBAC onboarding form and policy config modal

[kruulik]

Ticket ENG-3140

Description Of Changes

Rewrite the access policies onboarding page with a dynamic form that fetches data uses from the API based on industry and geography selections. Add a "Policy config" modal on the policies list page for updating geographies and submitting new policy documents after initial onboarding.

Key changes:

• Onboarding form with industry select, multi-select geographies (from locations API), dynamic data use cards, file upload, and URL input
• Policy config modal on the policies page that fetches saved config, allows geography updates and document/URL submission
• RTK Query endpoints for /access-policy/config, /access-policy/data-uses, and /access-policy/generate
• MSW mock handlers for all new endpoints
• Ant Design theme tokens instead of raw CSS variables for success state styling

Code Changes

• features/access-policies/OnboardingForm.tsx - Rewritten onboarding form with controlled state, RTK Query integration, multipart FormData submission
• features/access-policies/PolicySettingsModal.tsx - New modal for post-onboarding config updates (geographies + documents)
• features/access-policies/DataUseCard.tsx - Updated to accept dataUseId and look up display info from constants, uses Ant theme tokens
• features/access-policies/access-policies.slice.ts - Added getOnboardingConfig, getOnboardingDataUses, generatePolicies endpoints
• features/access-policies/types.ts - Added OnboardingConfigResponse, OnboardingDataUsesResponse, GeneratePoliciesResponse, OnboardingFormState
• features/access-policies/constants.ts - Added INDUSTRY_OPTIONS, DATA_USE_DISPLAY lookup map
• mocks/access-policies/handlers.ts - Added mock handlers for config, data-uses, and generate endpoints
• mocks/access-policies/onboarding-data.ts - Mock data use IDs
• pages/access-policies/index.tsx - Replaced "Onboarding" link with settings icon + PolicySettingsModal
• pages/access-policies/onboarding/index.tsx - Updated page layout with header description and remote form submit button
• .gitignore - Added .superpowers/ entry
• Deleted unused files: DataUseCardsSection, PrivacyPolicySection, RefiningScanInfoBox, PoliciesGrid, PolicyCard, PolicyCategoryGroup, PoliciesToolbar, mock-data, barrel index.ts

Steps to Confirm

1. Navigate to /access-policies/onboarding
2. Select an industry and one or more geographies — data use cards should load
3. Toggle data use selections, add a policy URL, upload a document
4. Click "Generate policies" — should navigate to /access-policies on success
5. On the policies page, click the "Policy config" settings button
6. Modal should open with pre-populated geographies from saved config
7. Update geographies, add URLs/documents, click "Suggest additional policies"

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
  • Updates unreleased work already in Changelog, no new entry necessary
• UX feedback:
  • All UX related changes have been reviewed by a designer
  • No UX review needed
• Followup issues:
  • Followup issues created
  • No followup issues
• Database migrations:
  • No migrations
• Documentation:
  • No documentation updates required

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ready	Preview, Comment	Apr 2, 2026 8:20pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
fides-privacy-center	Ignored		Apr 2, 2026 8:20pm

[kruulik]

We'll want this as we do more brainstorming with claude

[github-actions]

Title	Lines	Statements	Branches	Functions
admin-ui		5.69% (2415/42385)	4.57% (1098/24016)	3.8% (479/12595)
fides-js		78.98% (1962/2484)	65.55% (1214/1852)	72.57% (336/463)
privacy-center		83.18% (287/345)	77.15% (152/197)	75% (48/64)