Generative AI policy enforcement needs clearer unified approach
From Alignment to Access Control: A Framework for GenAI Policy Enforcement
Cryptography and SecurityArtificial Intelligence
Summary
Generative AI systems like chatbots and personal agents are developing very fast, but safety and security rules are not keeping up, causing problems. The authors look at how different groups use policies to try to keep these systems safe and compliant, but find these approaches are often confused and not connected. They provide a way to understand and compare these methods systematically and offer suggestions for improvement. This helps the AI community work better together to enforce rules in these systems.
What this means in practice
- •For ai security engineers: Design consistent and unified policy enforcement strategies for generative AI applications to improve safety and compliance.
- •For cloud platform operators: Integrate a clear framework for managing and enforcing policies on hosted generative AI services to reduce security incidents.
A position paper. It proposes an approach and reports no results.
Authors
Nathalie Baracaldo
Abstract
Generative AI (GenAI) applications have flourished enabling users to chat with large language models, and to create agents to act on their behalf for a variety of tasks. The pace of development of capabilities in this field is incredibly fast with security and safety taking a back seat. Unfortunately, the slower pace at which security and safety mechanisms have evolved has led to real incidents. Policy enables the definition of desirable behavior of applications, and for that reason, it is a cornerstone of making systems secure and compliant. Policy however means different things to different practitioners creating confusion and siloed solutions that are not adequate for compliance. This paper takes a tour of the good, the bad and the ugly when it comes to policy enforcement in GenAI applications. We propose a methodology to systematically analyze and dissect existing approaches to define and enforce policy found in the wild. Based on this principled analysis, we provide recommendations and call for action for the community to address. This paper is a companion extension of USENIX Security 2026 Enigma talk titled "From Alignment to Access Control: A Unified View of GenAI Policy Enforcement" by the author Nathalie Baracaldo.