Auditing the Hand-Written Inputs of Learned Access Control

Arsalan Jalil Sarghaleh; Mehdi Hazrati

cs.CROct 22, 2026

Auditing the Hand-Written Inputs of Learned Access Control

Authors: Arsalan Jalil Sarghaleh, Mehdi Hazrati

Organizations: Department of Electrical Engineering, Sharif University of Technology, Tehran, Iran · Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada

Abstract

Learned access control is typically deployed behind two hand-built artefacts: a hard-deny set enforced by a small trusted shield, and a region map that decides which requests mined rules answer and which the learner answers. Verifying the shield or measuring the learner validates neither. We audit both on the five public ABAC Lab policies. First, we formalise hard-deny soundness and check it exhaustively over relations of up to 794,250 tuples. Clauses that faithfully transcribe an explicit restriction are unsound at rates of 0.50-0.70 across four elicitors - an author and three blind language-model elicitors - because prose scopes restrictions to a section while the grant relation is a disjunction over all rules: 97% of counterexamples are granted by other rules. Shipped unchecked, these deny sets would withhold 16-78% of everything the policies grant; certified, they withhold nothing. Vacuity, a second silent failure, also occurs. Second, hybrid routing needs a two-class, abstaining rule set that ABAC miners do not emit, and ranking a mixed-effect candidate pool under a cap is one-class in all 24 cells for the two commonest ranking keys. Third, for additive losses the hybrid-versus-learner effect factorises into covered mass times a rule-learner risk contrast that must be reported on both false-non-grant and false-permit loss: on two real policies, most selection rules give opposite verdicts on the two losses, and the one favourable on both holds for one policy, one learner configuration and a band of noise levels. A released artefact regenerates and checks every reported number.

Figures & tables

Figure 1: The composed architecture, with the two hand-built artefacts this paper audits marked. An untrusted learner proposes an action; a deterministic shield admits no grant on the named hard-deny set

H

and is the identity outside it. The shield’s behaviour on

H

is a refinement property and is not in doubt (Lemma 1 ). What is in doubt is which requests are in

H

(Section 4 ) and which requests reach the learner at all (Sections 5 – 6 ). Neither is produced or checked by any verified component of the stack.

component	status	protects	failure consequence
learner $L$	untrusted	—	none on $H$ ; bounded by $\sigma$
shield $\sigma$	safety TCB	conformance on $H$	unbounded grants
hard-deny clauses	safety TCB	soundness of $H$	wrong denials (§ 4 )
attested store	safety TCB	attribute integrity	$\varepsilon^{-}_{H}>0$
actuator path	safety TCB	complete mediation	shield bypass
statistical gate	guarantee only	marginal FP rate	bound void; $H$ unaffected

Table 1: Components and trust status. The hard-deny clause set is in the safety TCB, and no amount of verification of the shield or of an authorization language detects an error in it. Section 4 audits exactly this row.

Figure 2: Hard-deny soundness as a first-class check. A clause read off the policy’s prose is admitted to

H

only if it covers no request the policy grants, verified exhaustively against the full grant relation rather than a sample. Because policy descriptions state local restrictions while the grant relation is a global disjunction, prose-derived restriction clauses over-claim by default (Table 2 ). An admitted clause must additionally be checked for non-vacuity (Section 4.8 ), which the same enumeration pass supplies at no extra cost.

policy	enum. tuples	expl.	other	expl. c/ex
E-Document [ 52 ]	600,000	12/14	1/2	495–6,489
Workforce [ 51 ]	794,250	4/9	0/1	20–7,665
University [ 2 ]	6,732	—	3/8	—
Project Mgmt [ 2 ]	3,040	—	2/6	—
Healthcare [ 2 ]	1,008	—	7/8	—
total		16/23	13/25	20–7,665

Table 2: Hard-deny soundness audit across all five public ABAC Lab policies, stratified by clause provenance.

provenance	$n$	unsound	rate [95% CI]
explicit-restriction (mechanism)	23	16	0.696 $[0.471,0.868]$
inferred-exclusivity	12	7	0.583 $[0.277,0.848]$
inferred-necessity	11	5	0.455 $[0.168,0.766]$
silence	2	1	0.500 $[0.013,0.987]$
elicitation-error strata (pooled)	25	13	0.520 $[0.313,0.722]$
all strata pooled (uninterpretable)	48	29	0.604 $[0.453,0.742]$

Table 3: Rejection rate by provenance, with exact Clopper–Pearson intervals (reported rather than a normal approximation because several strata have single-digit denominators). The strata are not pooled: only the first isolates the scope mismatch, and the pooled rate of

0.60

is reported solely to show what a study omitting this stratification would have published.

elicitor	model	unsound	rate [95% CI]	vac.	E-Doc.	Workf.
		mechanism stratum			grants denied
R1	author	16/23	0.696 $[0.471,0.868]$	0	0.516	0.548
L1	Opus 5.5	18/36	0.500 $[0.329,0.671]$	4	0.159	0.546
L2	Sonnet 5.5	22/38	0.579 $[0.408,0.737]$	5	0.265	0.593
L3	Haiku 5.5	23/35	0.657 $[0.478,0.809]$	3	0.702	0.780
L1–L3 pooled		63/109	0.578 $[0.480,0.672]$	12

Table 4: Author and independent elicitors compared. Mechanism stratum (explicit-restriction) with exact Clopper–Pearson intervals; “vac.” counts clauses that cover no request; the last two columns give the fraction of all granted requests that the elicitor’s unchecked candidate set would deny if shipped as

H

† $L=2$ over a 200,000-row sample; see caption.
		default-deny (total)		open-world (abstain)
policy	rules	permit-F1	$m$	covered	deny-F1
E-Document	35	0.934	0.000	0.048	0.000
University	10	0.930	0.000	0.022	0.000
Project Mgmt	8	0.865	0.000	0.025	0.000
Workforce †	1	0.006	0.000	0.000	0.000

Table 5: The published-miner reference arm, read three ways.

∗ the model Prop. 2 assumes. † nearly indistinguishable
noise process	mean conf.	sd	[email protected]	supp. shift
symmetric IID ∗	0.8491	0.0028	0.071	0.28
class-dependent †	0.8494	0.0028	0.073	0.29
attribute-dependent	0.8561	0.0020	0.158	0.60
block-correlated	0.8541	0.0180	0.299	0.75
from symmetric here: the reference set is almost entirely deny-

Table 6: Structured-noise robustness of Proposition 2 ’s two consequences.

selection rule	degen.	rate	minority	inf. mass
support	12/12	1.00	0.0	0.00
confidence (support tb)	12/12	1.00	0.0	0.16
confidence (low-support tb)	5/12	0.42	8.9	0.81
lift	3/12	0.25	152.5	0.31
class-balanced	0/12	0.00	90.6	0.16

Table 7: Selection-rule degeneracy over

4

policies

\times

3

cap sizes (

100/300/1000

), with an independently reimplemented miner. “Degenerate” means the retained rule set is one-class on the covered region; “minority” is the mean number of minority-class rules retained per cell and “inf. mass” the mean informative-region mass. Per-policy configurations: E-Document at conjunction cap

L{=}3

over a uniform 200,000-row sample (min. support 5); University and Project Management at

L{=}3

over the full relation (min. support 3); Workforce at

L{=}2

over a 200,000-row sample (min. support 5); minimum confidence

0.60

throughout. Region and F1 figures are estimated on a 50,000-row subsample where the relation is larger.

selection rule	deny	perm.	$m_{G}$	$r_{C}^{G}$	$\ell_{C}^{G}$	$r_{C}^{G}\!-\!\ell_{C}^{G}$ [95% CI]	$m_{N}$	$r_{C}^{N}$	$\ell_{C}^{N}$	$r_{C}^{N}\!-\!\ell_{C}^{N}$ [95% CI]	verdict
	cov.-region F1		false-non-grant (on grant subpop.)				false-permit (on non-grant subpop.)
support (all-deny)	0.971	0.000	0.000	1.000	0.058	$+0.942\ [+0.932,+0.950]$	0.000	0.000	0.303	$-0.303\ [-0.312,-0.294]$	metric-dep.
conf. (support tb)	0.990	0.179	0.931	0.870	0.148	$+0.721\ [+0.640,+0.796]$	0.839	0.000	0.188	$-0.188\ [-0.197,-0.178]$	metric-dep.
conf. (low-supp. tb)	0.971	0.133	0.927	0.917	0.105	$+0.812\ [+0.759,+0.859]$	0.930	0.003	0.333	$-0.330\ [-0.348,-0.310]$	metric-dep.
lift (all-permit)	0.000	0.766	0.122	0.000	0.048	$-0.048\ [-0.060,-0.038]$	0.968	1.000	0.715	$+0.285\ [+0.264,+0.308]$	metric-dep.
class-balanced	0.931	0.852	0.257	0.011	0.044	$\mathbf{-0.033\ [-0.049,-0.020]}$	0.879	0.125	0.240	$\mathbf{-0.115\ [-0.127,-0.104]}$	rules

Table 8: Direct measurement of the decomposition terms on E-Document, on both additive losses.

Figure 3: The routing verdict is a point in two-loss space, not a sign (E-Document, gbdt class-balanced, 20 seeds, 95% paired-bootstrap intervals; the data of Table 8 ). Routing the covered region to rules is justified only in the shaded quadrant, where both contrasts are negative. The one-class rule sets sit in opposite off-diagonal positions: an all-deny rule set cannot over-grant, so its false-permit contrast is as favourable as arithmetic allows, and an all-permit rule set cannot withhold a grant, so its false-non-grant contrast is. Either can be presented as a positive result by choosing a loss. Only class-aware selection lies in the shaded quadrant; the inset magnifies the two points near the origin and shows that both of its intervals exclude zero.

$\varepsilon$	rule	FNG contrast [95% CI]	FP contrast [95% CI]
0.00	support	$+0.976\ [+0.969,+0.981]$	$-0.114\ [-0.119,-0.110]$
	class-bal.	$-0.010\ [-0.016,-0.006]$	$+0.004\ [+0.003,+0.005]$
0.02	support	$+0.969\ [+0.964,+0.975]$	$-0.182\ [-0.186,-0.178]$
	class-bal.	$-0.017\ [-0.022,-0.012]$	$-0.043\ [-0.058,-0.031]$
0.05	support	$+0.962\ [+0.952,+0.970]$	$-0.221\ [-0.225,-0.217]$
	class-bal.	$-0.023\ [-0.033,-0.015]$	$-0.069\ [-0.078,-0.061]$

Table 9: Sensitivity of the two-loss verdict to the label-noise level (E-Document, gbdt class-balanced, 20 seeds per level; each level draws its own splits, so the

\varepsilon=0.15

rows differ slightly from Table 8 ). The support rows are metric-dependent at every level, in the direction Table 8 explains. The class-balanced rows favour rules on both losses for

0.02\leq\varepsilon\leq 0.15

; at

\varepsilon=0

the losses disagree, and at

\varepsilon=0.25

the false-non-grant interval includes zero.

learner	thr.	F1	FNG	FP contrast [95% CI]	verdict
default	.500	.587	$-0.862$	$+0.125\,[+.109,+.142]$	metric-dep.
balanced	.500	.547	$\mathbf{-0.027}$	$\mathbf{-0.108\,[-.126,-.091]}$	rules
tuned	.255	.709	$-0.180$	$+0.028\,[+.010,+.046]$	metric-dep.
bal.+tuned	.582	.699	$-0.197$	$+0.034\,[+.017,+.050]$	metric-dep.

Table 10: Is the routing verdict an artefact of an under-tuned learner? E-Document, class-aware selection,

\varepsilon=0.15

, 20 seeds; the mined rules are identical across rows (

r_{C}^{G}=0.012

throughout), so all variation is the learner’s. “tuned” selects the decision threshold on a held-out validation split (6,000 rows, drawn in addition to the training and test splits, so the balanced row is close to but not identical with the class-balanced row of Table 8 ). F1 is the learner’s macro-F1; FNG is the false-non-grant contrast. Only one of four configurations yields a route-to-rules verdict; on false-non-grant alone every row favours the rules.

selection rule	$m_{G}$	FNG contrast [95% CI]	FP contrast [95% CI]
support (all-deny)	0.000	$+.969\,[+.962,+.975]$	$-.198\,[-.206,-.190]$
conf. (support tb)	0.976	$+.737\,[+.662,+.810]$	$-.149\,[-.160,-.138]$
conf. (low-supp. tb)	0.975	$+.738\,[+.661,+.813]$	$-.150\,[-.160,-.139]$
lift	0.958	$+.348\,[+.272,+.424]$	$-.146\,[-.156,-.134]$
class-balanced	0.958	$+.348\,[+.272,+.424]$	$-.146\,[-.156,-.134]$

Table 11: The two-loss contrast on Workforce (

L=2

, 20 seeds,

\varepsilon=0.15

, class-balanced gbdt ). Every selection rule’s rules withhold grants that the learner makes (positive false-non-grant contrast) and over-grant less than the learner (negative false-permit contrast), with every interval excluding zero; no selection rule is favourable on both losses. Lift and class-aware selection retain the same rule set here.

	E-Document			Workforce
arm	FP	FNG	$H$ -gr.	FP	FNG	$H$ -gr.
learner	0.303	0.058	0.415	0.198	0.031	0.211
$+$ shield, certified $H$	0.284	0.058	0.000	0.164	0.031	0.000
$+$ shield, unchecked $H$	0.080	0.538	0.000	0.158	0.580	0.000
hybrid	0.288	0.033	0.395	0.187	0.046	0.198
$+$ shield, certified $H$	0.271	0.033	0.000	0.155	0.046	0.000

Table 12: The composed system on two real policies (class-balanced gbdt ,

\varepsilon=0.15

, 20 seeds; means). FP is the false-permit rate on non-granted requests, FNG the false-non-grant rate on granted ones, and

H

-grant the grant rate on requests in the certified set; zeros in that column for shielded arms are by construction. Bootstrap intervals are in the artefact.

arm	FP	deny	esc	$C(1)$	$H$ -grant	resid.
deny-by-default	0.0000	1.0000	0.0000	1.0000	0.0000	0.000
rules	0.2060	0.2714	0.0017	0.2731	0.2231	0.000
rules+shield	0.0000	0.2198	0.0000	0.2198	0.0000	0.000
learner (raw)	0.0289	0.0836	0.0000	0.0836	0.0238	0.276
learner+shield	0.0160	0.0947	0.0000	0.0947	0.0000	0.276
hybrid	0.2310	0.0507	0.0017	0.0524	0.2405	0.268

Table 13: Key arms on the synthetic policy ( gbdt , 20 seeds; mean per-seed denominators 2908/1092/2781/125 for FP/cost/

H

/residual).

H

-grant of

0.000

for shielded arms is by construction (Lemma 1 ); other zeros are observed. Every shielded and conformal arm in this table has

\mathrm{esc}=0.0000

, so the ranking among those arms is invariant in

\lambda

; only the selective arms are

\lambda

-sensitive.

corruption	$\varepsilon^{-}_{H}$	$\varepsilon^{+}_{H}$	$\varepsilon_{\mathrm{sym}}$	honest $L$	advers. $L$
abstraction	0.2680	0.0000	0.1862	0.0009	0.2680
missing attributes	0.5976	0.0000	0.4151	0.0279	0.5976
stale policy	0.1477	0.0000	0.1026	0.0292	0.1477
availability (control)	0.0000	0.4421	0.1350	0.0000	0.0000

Table 14: Directional assumption-failure analysis; every column computed on the same 30 seeds and test draws.

\varepsilon^{-}_{H}

is the safety-relevant hard-deny false-negative rate,

\varepsilon^{+}_{H}

the availability-side false-positive rate,

\varepsilon_{\mathrm{sym}}

symmetric disagreement; the last two columns are the realised grant rate on

H

under an honest learner and under an always-permit (adversarial) learner.

artefact	report	see
hard-deny set	soundness certificate, coverage of each clause, size of the enumerated relation	§ 4
elicitation	protocol, number of elicitors, provenance strata reported apart	§ 4.4 , § 4.6
mining	$\mathrm{minconf}$ against $\hat{\varepsilon}$ ; support distribution of retained rules	§ 5.2
region map	semantics (total or abstaining), class composition, full operator tuple	§ 5
routing	$r_{C}-\ell_{C}$ on every additive loss, with the learner configuration	§ 6
cost	denial and abstention separately; any price $\lambda$ stated	§ 7.3

Table 15: Reporting checklist for evaluations of learned access control behind a trusted layer.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

ID	strat.	verdict	cov.	c/ex	clause
HC1	excl.	unsound	68	9	action in [’addItem’] AND resource.type in HR AND NOT user.position in nurse
HC2	nec.	unsound	68	9	action in [’addItem’] AND resource.type in HR AND NOT user.ward = resource.ward
HC3	nec.	unsound	80	4	action in [’addNote’] AND resource.type in HR AND NOT user.uid = resource.patient
HC4	excl.	unsound	240	6	action in [’read’] AND resource.type in HRitem AND NOT user.uid = resource.author
HC5	nec.	unsound	236	8	action in [’read’] AND resource.type in HRitem AND NOT user.specialties > resource.topics
HC6	sil.	unsound	48	4	action in [’read’] AND resource.type in HRitem AND user.position in nurse

Appendix

Table 19

policy	rule	section / subsection	R1	L1	L2	L3
edocument	1	eDocs / General	U	U	U	U
edocument	3	eDocs / Helpdesk	S	S	–	–
edocument	7	Large Bank / Invoices	U	U	U	U
edocument	8	Large Bank / Banking Notes	U	U	U	U
edocument	9	Large Bank / Paychecks	U	U	U	U
edocument	10	Large Bank / Sales Offers	U	U	U	U

Appendix

Table 20

elicitor	clauses	c/ex	own rule	other subsect.	other tenant	scoped repair
R1	16	31,393	0.000	0.783	0.592	3/16
L1	17	17,192	0.034	0.819	0.661	1/18
L2	22	25,939	0.023	0.878	0.552	3/22
L3	22	62,930	0.055	0.905	0.661	4/23

Appendix

Table 21

E-Document arm	FP	FNG	$H$ -grant
learner	0.303 [0.294, 0.312]	0.058 [0.050, 0.068]	0.415 [0.377, 0.452]
learner+shield	0.284 [0.276, 0.292]	0.058 [0.050, 0.068]	0.000 [0.000, 0.000]
learner+shield(unchecked H)	0.080 [0.077, 0.083]	0.538 [0.528, 0.549]	0.000 [0.000, 0.000]
hybrid	0.288 [0.279, 0.298]	0.033 [0.028, 0.040]	0.395 [0.359, 0.431]
hybrid+shield	0.271 [0.262, 0.279]	0.033 [0.028, 0.040]	0.000 [0.000, 0.000]
hybrid+shield(unchecked H)	0.077 [0.074, 0.081]	0.522 [0.513, 0.534]	0.000 [0.000, 0.000]

Appendix

Table 22

Workforce arm	FP	FNG	$H$ -grant
learner	0.198 [0.190, 0.206]	0.031 [0.025, 0.038]	0.211 [0.187, 0.236]
learner+shield	0.164 [0.156, 0.173]	0.031 [0.025, 0.038]	0.000 [0.000, 0.000]
learner+shield(unchecked H)	0.158 [0.150, 0.167]	0.580 [0.568, 0.593]	0.000 [0.000, 0.000]
hybrid	0.187 [0.179, 0.194]	0.046 [0.038, 0.053]	0.198 [0.175, 0.223]
hybrid+shield	0.155 [0.147, 0.163]	0.046 [0.038, 0.053]	0.000 [0.000, 0.000]
hybrid+shield(unchecked H)	0.149 [0.141, 0.157]	0.590 [0.577, 0.603]	0.000 [0.000, 0.000]

Appendix

Table 23

$\lambda$ interval	arm	FP	DNG	ENG
$[0.0000,0.0023)$	[email protected]	0.0000	0.0000	0.7567
$[0.0023,0.0281)$	[email protected]	0.0001	0.0005	0.5765
$[0.0281,0.1007)$	[email protected]	0.0013	0.0049	0.4175
$[0.1007,0.1671)$	[email protected]	0.0041	0.0164	0.3038
$[0.1671,0.2142)$	[email protected]	0.0094	0.0336	0.2004
$[0.2142,1.0000)$	hybrid+shield	0.0156	0.0766	0.0000

Appendix

Table 24

test	property checked	cases	result
T1	no action of the shield grants on $H$ (Lemma 1 (i)) (attested=False)	5578 H-states x 5 actions = 27890 cases	PASS
T1	no action of the shield grants on $H$ (Lemma 1 (i)) (attested=True)	5578 H-states x 5 actions = 27890 cases	PASS
T2	break-glass set disjoint from $H$ (attested=False)	n=8000	PASS
T2	break-glass set disjoint from $H$ (attested=True)	n=8000	PASS
T3	break-glass set contains no request $P^{*}$ refuses (attested=False)	n=8000, violations=0	PASS
T3	break-glass set contains no request $P^{*}$ refuses (attested=True)	n=8000, violations=0	PASS

Appendix

Table 25

Access Control

Access control specifies and enforces who or what may access data and perform actions, under which conditions.

See all 71 papers

Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance
Sep 25, 2026Wesley Shu, Hsi-Ching LinAccess Control Reasoning Evaluation
The Institute of Energetic Paradigm · National Center for High-Performance Computing, Taiwan
AutoCedar: An Agentic Framework for Verifier-Guided Access Control Policy Synthesis
Jul 4, 2026Adarsh Vatsa, Sachi Shome, Yingming Zhou +1LLM-Based Program Synthesis Access Control
Stevens Institute of Technology
Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization
Oct 12, 2026Huihao Jing, Shaojin Chen, Wenbin Hu +5LLM Guardrails Tool-Use Authorization
HKUST

Sep 25, 2026J/K move · Enter open · S save

Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance

Wesley Shu, Hsi-Ching Lin

The Institute of Energetic Paradigm · National Center for High-Performance Computing, Taiwan

Access Control Reasoning Evaluation

Open paper AskPDF arXiv

Reasoning systems usually treat premise use as a question of relevance: if a fact is available and useful, it may be selected for inference. Authorization imposes a different constraint: a premise may be represented and logically usable but not permitted for a particular local transition. We formalize this distinction as Governed Deduction (GD), with a transition-local admission predicate admit(p, tau, S). From an independently produced RBAC-augmented Spider benchmark, we construct 4,461 matched authorization pairs in which the same query premise and policy state support permitted and denied consuming transitions. An initial joint controller reaches 99.19% held-out accuracy, but a transition-only control reaches 100%, exposing a role-name shortcut. After a frozen, label-independent context-local role permutation removes that shortcut, premise/state-only, transition-only, and joint linear controllers all score exactly 50% on 1,856 held-out edges, while a symbolic policy oracle remains at 100%. The result is a controlled negative finding: the benchmark instantiates policy-grounded authorization beyond relevance, but the frozen linear representation does not recover the relation. Matched one-sided controls and leakage audits are therefore essential for evaluating learned policy-sensitive reasoning.

Abstract

Access Control

Explore similar work

Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance

AutoCedar: An Agentic Framework for Verifier-Guided Access Control Policy Synthesis

Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization