Can a data security policy be added to a security role indirectly?

We discovered a data security policy for "Grant on Public Person" in one of our security roles in our PROD environment that is not in the same security role in a non-PROD environment that was cloned from PROD in the last couple of days. There were no manual security role changes in PROD, so I'm trying to figure out how the DSP could've been added to the role and am wondering whether a configuration setting change elsewhere in Oracle can somehow indirectly make it's way into a security role as a DSP. Appreciate any insight that someone may have. Thanks.