Do you have any legacy access points (26xx or 4102) in your configuration or any access points that have not been updated to the 8.32.x image??
General rule...
Default action is the last rule on the rules list. All your traffic will hit the filter rules before hitting the default action. Couple of things to point out...
Access - In Policy Rules List ( Most Common)
Allow = Puts the traffic in the default topology defined in the WLAN service else apply the default topology defined in the Global Default Policy (most cases B@AP Untagged)
Contain to VLAN = Traffic goes in the VLAN ID selected
Deny = Traffic is dropped if you match this rule
If you do not have an end rule that says deny all traffic then the default action is hit. The same access rules above apply.
Ap's with older code or ap's that do not support these advance access methods in the Filter Rules List will default to supporting contain to VLAN as the default action. If the access is set to allow on the individual rule line then the traffic will be placed in the default actions contain to VLAN ID.
Doug Hyde
Director, Technical Support / Extreme Networks