Text2NGAC extracts all four NGAC relationship types from policy text
Original title: Text2NGAC: a multi-LLM pipeline for NGAC policy extraction with mutation-based verification
Exact-tuple match was 97.3–99.6% on 714 sentences, and one graph loaded unmodified into NIST's implementation.
Text2NGAC is a multi-LLM pipeline that disambiguates sentences, escalates uncertain ones to an ensemble, and checks extracted NIST NGAC graphs with a five-strategy verifier measured by mutation testing. The authors say it is the first system to extract associations, prohibitions, event-response obligations, and assignments from real policy documents. The verifier detected 99.7% of 918 injected mutants and every structural fail-open fault. One corpus graph reproduced all 55 entailed access decisions and fired an extracted obligation.
Unconfirmed: Reported accuracy is wording- and benchmark-specific, and adversarial input is outside the verifier's guarantees.
- Missed fault classes are characterized and weighted by security consequence.
- Paraphrase probes with semantic re-scoring bound sensitivity to rewording.
- Intended deployment is extraction and structural verification before expert review.
- A complete two-tier reproducibility artifact accompanies the paper.
- Organizations
- NIST
From the original article
1 min read at arxiv.orgAccess-control policies are written in natural language but enforced as formal models, and translating them into NIST Next Generation Access Control (NGAC) graphs remains unsolved: prior systems cover only subsets of the NGAC model, and none verify the graphs they extract.
By Ayesha Habib · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.