# Prose2Policy (P2P): A Practical LLM Pipeline for Translating Natural-Language Access Policies into Executable Rego

arXiv: https://arxiv.org/abs/2603.15799 · HTML: https://mlsanity.com/paper/2603.15799/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 32 references that are in the map.
- First posted on arXiv 16 Mar 2026.

## Builds on (most cited first, 11 of 11)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [Program of Thoughts Prompting: Disentangling Computation from Reasoning for Numerical Reasoning Tasks](https://mlsanity.com/paper/2211.12588/) (2022)
- [Authenticated Delegation and Authorized AI Agents](https://mlsanity.com/paper/2501.09674/) (2025)
- [Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization (Extended Version)](https://mlsanity.com/paper/2403.04651/) (2024)
- [Governance-as-a-Service: A Multi-Agent Framework for AI System Compliance and Policy Enforcement](https://mlsanity.com/paper/2508.18765/) (2025)
- [SoK: Access Control Policy Generation from High-level Natural Language Requirements](https://mlsanity.com/paper/2310.03292/) (2023)
- [RAGent: Retrieval-based Access Control Policy Generation](https://mlsanity.com/paper/2409.07489/) (2024)
- [Multi-Agent Code-Orchestrated Generation for Reliable Infrastructure-as-Code](https://mlsanity.com/paper/2510.03902/) (2025)
- [ARPaCCino: An Agentic-RAG for Policy as Code Compliance](https://mlsanity.com/paper/2507.10584/) (2025)
- [ArGen: Auto-Regulation of Generative AI via GRPO and Policy-as-Code](https://mlsanity.com/paper/2509.07006/) (2025)

## Built on by (most cited first, 1 of 1)

- [AuthGateBench: Benchmarking LLMs as Authorization Gate](https://mlsanity.com/paper/2610.16426/) (2026)

## Abstract (arXiv)

Prose2Policy (P2P) is a LLM-based practical tool that translates natural-language access control policies (NLACPs) into executable Rego code (the policy language of Open Policy Agent, OPA). It provides a modular, end-to-end pipeline that performs policy detection, component extraction, schema validation, linting, compilation, automatic test generation and execution. Prose2Policy is designed to bridge the gap between human-readable access requirements and machine-enforceable policy-as-code (PaC) while emphasizing deployment reliability and auditability. We evaluated Prose2Policy on the ACRE dataset and demonstrated a 95.3% compile rate for accepted policies, with automated testing achieving a 82.2% positive-test pass rate and a 98.9% negative-test pass rate. These results indicate that Prose2Policy produces syntactically robust and behaviorally consistent Rego policies suitable for Zero Trust and compliance-driven environments.