# LMN: A Tool for Generating Machine Enforceable Policies from Natural Language Access Control Rules using LLMs

arXiv: https://arxiv.org/abs/2502.12460 · HTML: https://mlsanity.com/paper/2502.12460/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 2 of its 15 references that are in the map.
- First posted on arXiv 18 Feb 2025.

## Builds on (most cited first, 2 of 2)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Mining Attribute-Based Access Control Policies from Logs](https://mlsanity.com/paper/1403.5715/) (2014)

## Built on by (most cited first, 4 of 4)

- [Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things](https://mlsanity.com/paper/2505.23835/) (2025)
- [Can LLMs Make (Personalized) Access Control Decisions?](https://mlsanity.com/paper/2511.20284/) (2025)
- [LLM-Driven Auto Configuration for Transient IoT Device Collaboration](https://mlsanity.com/paper/2507.03064/) (2025)
- [Generation of Human Comprehensible Access Control Policies from Audit Logs](https://mlsanity.com/paper/2603.14341/) (2026)

## Abstract (arXiv)

Organizations often lay down rules or guidelines called Natural Language Access Control Policies (NLACPs) for specifying who gets access to which information and when. However, these cannot be directly used in a target access control model like Attribute-based Access Control (ABAC). Manually translating the NLACP rules into Machine Enforceable Security Policies (MESPs) is both time consuming and resource intensive, rendering it infeasible especially for large organizations. Automated machine translation workflows, on the other hand, require information security officers to be adept at using such processes. To effectively address this problem, we have developed a free web-based publicly accessible tool called LMN (LLMs for generating MESPs from NLACPs) that takes an NLACP as input and converts it into a corresponding MESP. Internally, LMN uses the GPT 3.5 API calls and an appropriately chosen prompt. Extensive experiments with different prompts and performance metrics firmly establish the usefulness of LMN.