LLMs Show Mixed Promise for Cloud Access Control Policy Generation

A recent research paper explores whether large language models can automate the creation and analysis of access control policies in cloud systems—a task that currently requires manual work by administrators and often contains security errors.

The Challenge of Policy Management#

Cloud platforms require administrators to write detailed policies that govern how users access sensitive information. These policies are technically complex and frequently contain mistakes. Additionally, understanding what existing policies actually allow or restrict is difficult, making it hard to verify they function as intended.

Testing LLMs for Policy Synthesis#

Researchers evaluated different LLM approaches for automatically generating access control policies from specifications. They found a significant gap between syntax and semantics: while models could reliably produce policies with correct structure, they struggled to generate policies that precisely matched the intended behavior. Standard LLMs produced equivalent policies only 45.8% of the time, whereas reasoning-enhanced models improved this to 93.7%—suggesting a notable permissiveness problem, where generated policies are overly broad.

A Semantic Approach to Policy Analysis#

Rather than focusing solely on generation, the team developed a novel method combining LLMs with symbolic approaches to analyze existing policies. Instead of just parsing text, they used LLMs to create precise semantic summaries describing which access requests a policy actually permits. This hybrid strategy showed more encouraging results, indicating LLMs are better suited for clarifying policy behavior than creating policies from scratch.

What Comes Next#

The findings suggest that while automated policy generation remains challenging, LLMs offer real value when working alongside traditional symbolic methods to help administrators understand and audit their security configurations.