AutoCedar: An Agentic Framework for Verifier-Guided Access Control Policy Synthesis

• URL: http://arxiv.org/abs/2607.03656v1
• Date: Sat, 04 Jul 2026 01:13:32 GMT
• Title: AutoCedar: An Agentic Framework for Verifier-Guided Access Control Policy Synthesis
• Abstract summary: AutoCedar is a verifier-guided system that turns natural-language access-control requirements into a reviewed, checkable target.<n>It then synthesizes Cedar policies against that target.
• Score: 0.2449909275410288
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large Language Models are increasingly used to turn natural-language requirements into code. In access control, that shortcut is dangerous: a generated policy can compile and read correctly while granting access that no one approved. The difficulty is not only writing policy code. It is fixing what the requirements mean before code is written, and then checking that the final policy actually satisfies that intent. We present AutoCedar, a verifier-guided system that first turns natural-language access-control requirements into a reviewed, checkable target, and then synthesizes Cedar policies against that target. AutoCedar decomposes schema and policy authoring into small intent atoms: reviewable claims about vocabulary and behavior. Once those atoms pass mechanical validation and human intent review, the model proposes a candidate policy, the verifier checks it against the approved target, and each failure is turned into a repair signal that tells the model whether to broaden, narrow, or restructure the policy without changing the target. Because the model's work is split into small problems, each grounded in reviewed intent and backed by verifier feedback, end-to-end policy authoring becomes tractable. AutoCedar converges on all 221 tasks of CedarBench, our benchmark of authorization tasks paired with executable semantic boundaries. Across three requirements-corpus case studies covering healthcare, education, and conference management, AutoCedar converts noisy prose and extracted access-control fragments into reviewed schemas, formal checks, and a globally verified Cedar policy store for each scenario.

Related papers

• Access Control as Verified Parse Constraints [2.230473633870735]
  Security gateways repeatedly ship implementation bugs in the code path between the network and the policy decision.<n>Existing approaches either leave the enforcement unverified or connect a formal model to a hand-written engine only by differential testing.<n>Our contribution is a class result: a forward-only, backtrack-free EverParse validator.
  arXiv  Detail & Related papers  (2026-09-11T06:33:41Z)
• From Natural Language Policies to Executable Obligations: A Verification Harness for Dependable In-Car LLM Agents [0.5352699766206808]
  We present AgentGuardUtil, our entry to CAR-bench Track1, which treats the AI planer (LLM) as a fallible proposer inside a grounded verify-and-revise loop.<n>The natural-language policy shipped with each conversation is compiled, once per policy, into typed machine-checkable rules.<n>A deterministic obligation engine interprets these rules against live tool results and the simulated post-write state of the draft itself.
  arXiv  Detail & Related papers  (2026-08-24T14:06:21Z)
• Tencent WorkBuddy Bench: A Multi-Domain Coding-Agent Benchmark with Contamination-Resistant Task Construction [57.138342889101345]
  Tencent WorkBuddy Bench is a multi-domain evaluation suite for coding agents.<n>This report documents its construction methodology, scoring protocol, and a cross-model leaderboard.
  arXiv  Detail & Related papers  (2026-07-23T04:34:06Z)
• Falsifiable Release Gates for Self-Improving Systems [0.0]
  We describe falsifiable release gates, and a methodology to build and validate such systems.<n>Every new capability must pass a pre-specified, machine-verifiable acceptance suite before it ships.<n>No action goes to an effector without a safety-critical property capability token minted by a control ring.
  arXiv  Detail & Related papers  (2026-07-11T06:06:34Z)
• Agentic AutoResearch forSpace Autonomy: An Auditable, LLM-Driven Research Agent for Aerospace Control Problems [2.258690092379457]
  AutoResearch is a framework in which a large language model autonomously drives a loop for aerospace control problems.<n>No reported result is credited until it passes three checks: measured per-problem seed noise, reseeded verification of the best configuration, and leave-one-out pruning of the agent's edits.
  arXiv  Detail & Related papers  (2026-06-18T15:48:25Z)
• Can Generalist Agents Automate Data Curation? [58.652262227632406]
  Curating training data is among the most consequential yet labor-intensive parts of modern AI development.<n>We ask whether generalist coding agents can automate this data-curation loop.<n>We introduce *Curation-Bench*, an agent-centric benchmark that fixes the model, training recipe, and evaluation suite.
  arXiv  Detail & Related papers  (2026-06-02T22:26:53Z)
• Citation-Closure Retrieval and Per-Rule Attribution for Real-World Regulatory Compliance Question Answering [54.97384993676565]
  We formalize Regulatory Compliance QA with RegOps-Bench, a novel benchmark featuring an Operational Knowledge Graph derived from complex national R&D regulations.<n>RefWalk traverses cross-document citations, fuses multi-view candidates via max-based aggregation, and enforces per-rule attribution to explicitly map claims to sources.
  arXiv  Detail & Related papers  (2026-05-28T10:38:38Z)
• Do Coding Agents Understand Least-Privilege Authorization? [14.240332406666779]
  We study whether current models can infer authorization boundaries themselves.<n>We show that frontier models often omit permissions required by the execution chain while also granting unused or sensitive accesses.<n>We propose Sufficiency-Tightness Decomposition, which first generates a coverage-oriented policy and then audits each granted entry for grounding and sensitivity.
  arXiv  Detail & Related papers  (2026-05-14T14:05:58Z)
• PolicyBank: Evolving Policy Understanding for LLM Agents [51.86716874651299]
  PolicyBank maintains structured, tool-level policy insights and iteratively refines them.<n>PolicyBank closes up to 82% of the gap toward a human oracle.
  arXiv  Detail & Related papers  (2026-04-16T20:29:30Z)
• Polaris: A Gödel Agent Framework for Small Language Models through Experience-Abstracted Policy Repair [0.9780193377233132]
  We introduce Polaris, a Gdel agent for compact models that performs policy repair via experience abstraction.<n>Unlike response level self correction or parameter tuning, Polaris makes policy level changes with small, auditable patches that persist in the policy.<n>As part of the loop, the agent engages in meta reasoning: it explains its errors, proposes concrete revisions to its own policy, and then updates the policy.
  arXiv  Detail & Related papers  (2026-03-24T12:25:32Z)
• QuadSentinel: Sequent Safety for Machine-Checkable Control in Multi-agent Systems [22.833567409552074]
  textscQuadSentinel is a four-agent guard that compiles safety policies into machine-checkable rules.<n>textscQuadSentinel improves guardrail accuracy and rule recall while reducing false positives.
  arXiv  Detail & Related papers  (2025-12-18T07:58:40Z)
• Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols [80.68060125494645]
  We study adaptive attacks by an untrusted model that knows the protocol and the monitor model.<n>We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs.
  arXiv  Detail & Related papers  (2025-10-10T15:12:44Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Few-shot Policy (de)composition in Conversational Question Answering [54.259440408606515]
  We propose a neuro-symbolic framework to detect policy compliance using large language models (LLMs) in a few-shot setting.<n>We show that our approach soundly reasons about policy compliance conversations by extracting sub-questions to be answered, assigning truth values from contextual information, and explicitly producing a set of logic statements from the given policies.<n>We apply this approach to the popular PCD and conversational machine reading benchmark, ShARC, and show competitive performance with no task-specific finetuning.
  arXiv  Detail & Related papers  (2025-01-20T08:40:15Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.