Reparo: LLM-aided pipeline for access control policy synthesis and validation
Original title: Reparo: Synthesizing and Validating Access Control Policies
Reparo synthesizes and repairs policies from repository evidence for Cedar, OpenFGA, and Rego, achieving 99.0-100% valid policies.
Reparo is an LLM-aided pipeline for access control policy synthesis, repair, and validation. It collects repository evidence for authorization intent to guide LLM-generated policies, then uses official validation tools to identify and automatically repair errors. For semantic validation, another LLM derives behavioral oracles of authorization requests with expected decisions, which Reparo executes against the policy. Evaluation on 228 GitHub repositories shows 40.6-55.7% policies fail language validation, while Reparo produces 99.0-100% valid policies. Oracle agreement ranges from 76.3-99.6%, with manual review confirming 91.5-96.9% of sampled cases as correct. Processing one repository takes about five minutes at a cost of $0.55-$1.57.
Unconfirmed: Manual assessment on a statistically sized sample of 390 test cases
- Synthesizes policies for 228 GitHub repositories using Cedar, OpenFGA, or Rego
- 40.6-55.7% of repository policies fail language validation
- Produces 99.0-100% valid policies after repair
- Oracle agreement: 76.3-99.6% for OpenFGA, 82.0-86.5% for Cedar, 76.3-80.2% for Rego
- Manual review confirms 91.5-96.9% of sampled test cases as correct
From the original article
1 min read at arxiv.orgWriting correct access control policies for software applications is difficult because it requires expertise in the authorization language and a thorough understanding of the application's authorization requirements. Existing synthesis and mining approaches assume explicit authorization inputs and a trusted reference policy.
By Ayesha Binte Mostofa · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.