Generation, Not Selection: LLM Proposals for Certified Access-Control Policy Mining

Gautam Kumar; Ravi Sundaram; Shamik Sural

cs.CROct 27, 2026

Generation, Not Selection: LLM Proposals for Certified Access-Control Policy Mining

Authors: Gautam Kumar, Ravi Sundaram, Shamik Sural

Organizations: Indian Institute of Technology Kharagpur, India · Northeastern University, USA

Abstract

Attribute-Based Access Control (ABAC) policy mining---recovering a compact, auditable policy from an access log---is posed as minimum set cover and solved greedily, which enjoys an $s^{*}(1+\ln m)$ guarantee. That guarantee is conditional on a precondition the literature never states: the candidate pool handed to greedy must contain the optimal rules. Generation, not selection, is the binding constraint, and existing generators are purely syntactic---they surface a rule only when enough log records witness it, so they fail on precisely the rare exception rules that fill a heavy-tailed policy. We replace the generator with a language model proposing rules semantically, from attribute names, and keep the combinatorial selector to carry the guarantee: every proposal is filtered against the observed denials, so soundness is independent of the proposal mechanism and an unreliable proposer can only waste candidates, never grant access. Over five seeds on each of two enterprise domains, adding semantic proposal to a syntactic miner dominates it on ten of ten runs---strictly better on seven---with near-optimal policies ( $9.2$ -- $9.6$ rules against $s^{*}=9$ , versus $11.2$ -- $14.6$ ) and false grants cut four- to sevenfold. Replacing the syntactic miner rather than augmenting it wins only where witnesses are scarce. An anonymization ablation isolates the mechanism: opaque attribute names cost two thirds of the model's rule recovery while leaving the syntactic baselines provably unmoved, and cost nothing where witnesses are plentiful. Semantic knowledge and log evidence are substitutes.

Figures & tables

		$\mathsf{Recall}_{0.9}$	$\|\hat{\Pi}\|$	held-out recall	held-out false grants
D1	FCA	$0.800\pm 0.050$	$14.6\pm 2.8$	$0.988\pm 0.006$	$0.048\pm 0.016$
	LLM	$0.911\pm 0.122$	$\mathbf{8.4\pm 0.9}$	$0.994\pm 0.008$	$\mathbf{0.003\pm 0.005}$
	LLM $\cup$ FCA	$\mathbf{0.956\pm 0.061}$	$9.6\pm 1.3$	$\mathbf{0.998\pm 0.003}$	$0.013\pm 0.007$
D2	FCA	$0.933\pm 0.061$	$11.2\pm 2.0$	$0.995\pm 0.006$	$0.013\pm 0.013$
	LLM	$0.822\pm 0.168$	$\mathbf{8.8\pm 0.8}$	$0.975\pm 0.023$	$\mathbf{0.003\pm 0.005}$
	LLM $\cup$ FCA	$\mathbf{0.978\pm 0.050}$	$9.2\pm 0.4$	$\mathbf{1.000\pm 0.000}$	$\mathbf{0.002\pm 0.004}$

Table 1: Five seeds per domain, mean

\pm

sd,

s^{*}=9

; the rarest rule has

6

–

12

witnesses on D1,

19

–

23

on D2. Held-out false grants are the fraction of unseen denials authorized by

\hat{\Pi}

; on observed denials every pool admits zero by construction (Proposition 5 ).

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

	seed 0	seed 1	seed 2	seed 3	seed 4
SG	0.22 / 55 / 0.150	0.67 / 18 / 0.050	0.56 / 61 / 0.108	0.56 / 36 / 0.100	0.67 / 37 / 0.058
FCA	0.78 / 14 / 0.050	0.78 / 12 / 0.042	0.89 / 12 / 0.042	0.78 / 17 / 0.033	0.78 / 18 / 0.075
LLM	1.00 / 9 / 0.008	0.78 / 8 / 0.008	1.00 / 9 / 0.000	0.78 / 7 / 0.000	1.00 / 9 / 0.000
LLM $\cup$ FCA	1.00 / 9 / 0.008	0.89 / 9 / 0.017	1.00 / 9 / 0.008	0.89 / 12 / 0.025	1.00 / 9 / 0.008

Appendix

Table 2: D1, general IT (rarest rule 6–12 witnesses). Per seed:

\mathsf{Recall}_{0.9}

|\hat{\Pi}|

/ held-out false-grant rate.

	seed 0	seed 1	seed 2	seed 3	seed 4
SG	0.44 / 73 / 0.175	0.89 / 21 / 0.050	0.44 / 46 / 0.092	0.44 / 46 / 0.125	0.67 / 37 / 0.108
FCA	1.00 / 9 / 0.000	0.89 / 13 / 0.008	0.89 / 12 / 0.033	1.00 / 9 / 0.008	0.89 / 13 / 0.017
LLM	0.78 / 8 / 0.000	1.00 / 9 / 0.000	0.89 / 8 / 0.000	0.89 / 9 / 0.008	0.56 / 10 / 0.008
LLM $\cup$ FCA	1.00 / 9 / 0.000	1.00 / 9 / 0.000	1.00 / 9 / 0.000	1.00 / 9 / 0.008	0.89 / 10 / 0.000

Appendix

Table 3: D2, financial services (rarest rule 19–23 witnesses). Per seed:

\mathsf{Recall}_{0.9}

|\hat{\Pi}|

/ held-out false-grant rate.

proposer	D1	D2
ChatGPT (GPT-5.6, free tier)	$0.22$	$0.33$
Claude Sonnet 5, medium effort	$0.11$	$0.56$
Claude Opus 5, max effort	$\mathbf{0.67}$	$0.56$
Gemini Flash, regular thinking	$0.44$	$\mathbf{0.78}$
Gemini Pro, extended thinking	$0.44$	$0.67$

Appendix

Table 4:

\mathsf{Recall}_{0.9}

of the LLM-only pool, seed 0, round 1. FCA scores

0.78

(D1) and

1.00

(D2) on the same instances.

$s$	$0$	$1$	$1.5$	$2$	$2.5$	$3$	$3.5$
min witnesses	$66$	$76$	$49$	$30$	$15$	$10$	$5$
FCA $\mathsf{Recall}_{0.9}$	$1.00$	$1.00$	$1.00$	$0.96$	$0.87$	$0.82$	$0.72$
FCA $\|\hat{\Pi}\|$	$9.0$	$9.0$	$9.0$	$11.2$	$12.0$	$13.2$	$14.5$

Appendix

Table 5: FCA degrades monotonically once the tail is heavy enough. ‘min witnesses’ is the rarest ground-truth rule’s support.

$m$	$200$	$400$	$800$	$1600$	$3200$
exhaustive $\binom{m}{3}$	$1.3\times 10^{6}$	$1.1\times 10^{7}$	$8.5\times 10^{7}$	$6.8\times 10^{8}$	$5.5\times 10^{9}$
FCA time (s, capped)	$0.56$	$0.70$	$1.07$	$1.07$	$1.55$
SG time (s)	$0.02$	$0.04$	$0.07$	$0.14$	$0.36$
LLM prompt (chars)	$20{,}261$	$20{,}247$	$20{,}250$	$20{,}212$	$20{,}154$

Appendix

Table 6: Two seeds,

s=2.5

. Exhaustive FCA is infeasible, so the enumeration is capped at

2\times 10^{5}

sampled groups; the price of the cap is coverage of the closure space, not wall time. The prompt is flat in

m

by construction, the proposer seeing a fixed sample of the log.

	D1 (witnesses scarce)		D2 (plentiful)
	named	anonymized	named	anonymized
LLM $\mathsf{Recall}_{0.9}$	$1.000$	$\mathbf{0.333}$	$0.778$	$0.778$
LLM held-out recall	$1.000$	$0.750$	$0.968$	$0.968$
unsafe proposals, round 2	—	$28/30$	—	—
refinement lift, recall	$+0.333$	$+0.111$	—	—
SG, FCA (all metrics)	identical across conditions

Appendix

Table 7: Claude Opus 5 max effort, seed 0, two rounds in each condition.

Access Control

Access control specifies and enforces who or what may access data and perform actions, under which conditions.

See all 73 papers

Mar 15, 2026

Generation of Human Comprehensible Access Control Policies from Audit Logs

Over the years, access control systems have become increasingly more complex, often causing a disconnect between what is envisaged by the stakeholders in decision-making positions and the actual permissions granted as evidenced from access logs. For instance, Attribute-based Access Control (ABAC), which is a flexible yet complex model typically configured by system security officers, can be made understandable to others only when presented at a high level in natural language. Although several algorithms have been proposed in the literature for automatic extraction of ABAC rules from access logs, there is no attempt yet to bridge the semantic gap between the machine-enforceable formal logic and human-centric policy intent. Our work addresses this problem by developing a framework that generates human understandable natural language access control policies from logs. We investigate to what extent the power of Large Language Models (LLMs) can be harnessed to achieve both accuracy and scalability in the process. Named LANTERN (LLM-based ABAC Natural Translation and Explanation for Rule Navigation), we have instantiated the framework as a publicly accessible web based application for reproducibility of our results.

Gautam Kumar, Ravi Sundaram, Shamik Sural

Indian Institute of Technology Kharagpur, India · Northeastern University, Boston, USA

Access Control Text Generation

Ask PDF

Sep 21, 2026

Structured Decomposition for Reliable LLM-Generated Access Control Policies

This paper presents an LLM-based system that translates natural-language access control policies (NLACPs) into executable Rego code for Open Policy Agent (OPA). It provides a modular, end-to-end pipeline for policy detection, component extraction, schema validation, linting, compilation, and automated test generation and execution. The system is designed to bridge the gap between human-readable access requirements and machine-enforceable policy-as-code (PaC), with a focus on deployment reliability and security correctness. We evaluate the system on 372 ACRE-complete access control statements with non-null subject, action, and resource annotations against a direct single-prompt LLM baseline to isolate the contribution of structured decomposition and schema-aware validation. The system achieves a 50.3% end-to-end policy correctness rate, compared with 15.3% for the baseline, representing a 3.3x improvement. A policy is counted as correct only if it satisfies compilation, linting, and both positive and negative tests, making this a strict measure of deployable correctness. On security-critical patterns, the system generates correct deny semantics for 87.5% of deny policies (baseline: 37.5%), ownership conditions for 100% of ownership-qualified policies (baseline: 40%), and status-qualified conditions for 100% of status-qualified policies (baseline: 55.6%). These results indicate that structured decomposition and schema-aware validation play a critical role in improving the reliability of LLM-generated authorization policies.

Vatsal Gupta, Darshan Sreenivasamurthy

Apple Inc., Cupertino, CA, USA

Access Control LLM Reliability Task Decomposition

Ask PDF

Oct 22, 2026

Auditing the Hand-Written Inputs of Learned Access Control

Learned access control is typically deployed behind two hand-built artefacts: a hard-deny set enforced by a small trusted shield, and a region map that decides which requests mined rules answer and which the learner answers. Verifying the shield or measuring the learner validates neither. We audit both on the five public ABAC Lab policies. First, we formalise hard-deny soundness and check it exhaustively over relations of up to 794,250 tuples. Clauses that faithfully transcribe an explicit restriction are unsound at rates of 0.50-0.70 across four elicitors - an author and three blind language-model elicitors - because prose scopes restrictions to a section while the grant relation is a disjunction over all rules: 97% of counterexamples are granted by other rules. Shipped unchecked, these deny sets would withhold 16-78% of everything the policies grant; certified, they withhold nothing. Vacuity, a second silent failure, also occurs. Second, hybrid routing needs a two-class, abstaining rule set that ABAC miners do not emit, and ranking a mixed-effect candidate pool under a cap is one-class in all 24 cells for the two commonest ranking keys. Third, for additive losses the hybrid-versus-learner effect factorises into covered mass times a rule-learner risk contrast that must be reported on both false-non-grant and false-permit loss: on two real policies, most selection rules give opposite verdicts on the two losses, and the one favourable on both holds for one policy, one learner configuration and a band of noise levels. A released artefact regenerates and checks every reported number.

Arsalan Jalil Sarghaleh, Mehdi Hazrati

Department of Electrical Engineering, Sharif University of Technology, Tehran, Iran · Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada

Access Control Algorithmic Auditing

Ask PDF

Abstract

Access Control

Explore similar work

Generation of Human Comprehensible Access Control Policies from Audit Logs

Structured Decomposition for Reliable LLM-Generated Access Control Policies

Auditing the Hand-Written Inputs of Learned Access Control