# SoK: Access Control Policy Generation from High-level Natural Language Requirements

arXiv: https://arxiv.org/abs/2310.03292 · HTML: https://mlsanity.com/paper/2310.03292/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 116 references that are in the map.
- First posted on arXiv 5 Oct 2023.

## Builds on (most cited first, 14 of 14)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Training language models to follow instructions with human feedback](https://mlsanity.com/paper/2203.02155/) (2022)
- [Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer](https://mlsanity.com/paper/1910.10683/) (2019)
- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [Parameter-Efficient Transfer Learning for NLP](https://mlsanity.com/paper/1902.00751/) (2019)
- [Simple BERT Models for Relation Extraction and Semantic Role Labeling](https://mlsanity.com/paper/1904.05255/) (2019)
- [Unveiling Security, Privacy, and Ethical Concerns of ChatGPT](https://mlsanity.com/paper/2307.14192/) (2023)
- [Neural Open Information Extraction](https://mlsanity.com/paper/1805.04270/) (2018)
- [Explainable Security](https://mlsanity.com/paper/1807.04178/) (2018)
- [A Survey of Syntactic-Semantic Parsing Based on Constituent and Dependency Structures](https://mlsanity.com/paper/2006.11056/) (2020)
- [Machine Learning in Access Control: A Taxonomy and Survey](https://mlsanity.com/paper/2207.01739/) (2022)
- [Human Factors in Security Research: Lessons Learned from 2008-2018](https://mlsanity.com/paper/2103.13287/) (2021)

## Built on by (most cited first, 5 of 5)

- [RAGent: Retrieval-based Access Control Policy Generation](https://mlsanity.com/paper/2409.07489/) (2024)
- [Prose2Policy (P2P): A Practical LLM Pipeline for Translating Natural-Language Access Policies into Executable Rego](https://mlsanity.com/paper/2603.15799/) (2026)
- [LLM-Driven Auto Configuration for Transient IoT Device Collaboration](https://mlsanity.com/paper/2507.03064/) (2025)
- [Neurosymbolic Characterization for Reliable Access Control Policy Analysis](https://mlsanity.com/paper/2510.20692/) (2025)
- [Structured Decomposition for Reliable LLM-Generated Access Control Policies](https://mlsanity.com/paper/2609.24036/) (2026)

## Abstract (arXiv)

Administrator-centered access control failures can cause data breaches, putting organizations at risk of financial loss and reputation damage. Existing graphical policy configuration tools and automated policy generation frameworks attempt to help administrators configure and generate access control policies by avoiding such failures. However, graphical policy configuration tools are prone to human errors, making them unusable. On the other hand, automated policy generation frameworks are prone to erroneous predictions, making them unreliable. Therefore, to find ways to improve their usability and reliability, we conducted a Systematic Literature Review analyzing 49 publications, to identify those tools, frameworks, and their limitations. Identifying those limitations will help develop effective access control policy generation solutions while avoiding access control failures.