Learned access control audits reveal high rates of silent permission errors
Auditing the Hand-Written Inputs of Learned Access Control
Cryptography and SecurityArtificial Intelligence
Summary
Access control systems decide who can do what in software, often using rules learned from data plus some fixed restrictions. The authors found that the fixed rules meant to block unwanted access often fail silently, allowing unintended permissions because they misunderstand how restrictions apply. They also showed common learning methods don't produce the proper rules needed for combining fixed and learned controls. Finally, their analysis revealed different ways to measure errors can give opposite results, complicating assessment. They provide tools to check and reproduce these findings.
What this means in practice
- •For security engineers: Validate and audit fixed denial rules in mixed learned and hand-built access control systems to prevent unintended permissions or over-restriction.
- •For access control system developers: Improve design of learning algorithms and hybrid routing methods to produce rule sets that correctly combine fixed denials with learned permissions.
Authors
Arsalan Jalil Sarghaleh, Mehdi Hazrati
Abstract
Learned access control is typically deployed behind two hand-built artefacts: a hard-deny set enforced by a small trusted shield, and a region map that decides which requests mined rules answer and which the learner answers. Verifying the shield or measuring the learner validates neither. We audit both on the five public ABAC Lab policies. First, we formalise hard-deny soundness and check it exhaustively over relations of up to 794,250 tuples. Clauses that faithfully transcribe an explicit restriction are unsound at rates of 0.50-0.70 across four elicitors - an author and three blind language-model elicitors - because prose scopes restrictions to a section while the grant relation is a disjunction over all rules: 97% of counterexamples are granted by other rules. Shipped unchecked, these deny sets would withhold 16-78% of everything the policies grant; certified, they withhold nothing. Vacuity, a second silent failure, also occurs. Second, hybrid routing needs a two-class, abstaining rule set that ABAC miners do not emit, and ranking a mixed-effect candidate pool under a cap is one-class in all 24 cells for the two commonest ranking keys. Third, for additive losses the hybrid-versus-learner effect factorises into covered mass times a rule-learner risk contrast that must be reported on both false-non-grant and false-permit loss: on two real policies, most selection rules give opposite verdicts on the two losses, and the one favourable on both holds for one policy, one learner configuration and a band of noise levels. A released artefact regenerates and checks every reported number.