Structured Decomposition for Reliable LLM-Generated Access Control Policies
Organizations: Apple Inc., Cupertino, CA, USA
Abstract
This paper presents an LLM-based system that translates natural-language access control policies (NLACPs) into executable Rego code for Open Policy Agent (OPA). It provides a modular, end-to-end pipeline for policy detection, component extraction, schema validation, linting, compilation, and automated test generation and execution. The system is designed to bridge the gap between human-readable access requirements and machine-enforceable policy-as-code (PaC), with a focus on deployment reliability and security correctness. We evaluate the system on 372 ACRE-complete access control statements with non-null subject, action, and resource annotations against a direct single-prompt LLM baseline to isolate the contribution of structured decomposition and schema-aware validation. The system achieves a 50.3% end-to-end policy correctness rate, compared with 15.3% for the baseline, representing a 3.3x improvement. A policy is counted as correct only if it satisfies compilation, linting, and both positive and negative tests, making this a strict measure of deployable correctness. On security-critical patterns, the system generates correct deny semantics for 87.5% of deny policies (baseline: 37.5%), ownership conditions for 100% of ownership-qualified policies (baseline: 40%), and status-qualified conditions for 100% of status-qualified policies (baseline: 55.6%). These results indicate that structured decomposition and schema-aware validation play a critical role in improving the reliability of LLM-generated authorization policies.
Figures & tables
| Metric | Direct LLM | Solution Pipeline |
|---|---|---|
| Input acceptance rate (attempted) | 20.7% (77/372) | 55.4% (206/372) |
| Compile OK | 20.7% | 54.0% |
| Lint pass | 17.5% | 53.8% |
| Positive test pass | 17.7% | 51.3% |
| Negative test pass | 19.9% | 53.2% |
| Effective correct coverage | 15.3% | 50.3% |
| Metric | Direct LLM | Solution Pipeline |
|---|---|---|
| Compile OK | 100.0% | 97.4% |
| Lint pass | 84.4% | 96.1% |
| Positive test pass | 85.7% | 92.2% |
| Negative test pass | 96.1% | 97.4% |
| All four pass | 74.0% | 90.9% |
| Property | Direct LLM | Solution Pipeline |
|---|---|---|
| Deny-rule completeness ( ) | 37.5% (3/8) | 87.5% (7/8) |
| Role check present † | 90.9% | 87.0% |
| Ownership condition ( ) | 40.0% | 100% |
| Status condition ( ) | 55.6% | 100% |
| Correct default semantics | 100.0% | 97.4% |
| Hallucinated input fields | 0.0% | 0.0% |
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Access Control
Access control specifies and enforces who or what may access data and perform actions, under which conditions.
See all 71 papers