Audits expose risks in hand-written access control

When learned access-control systems combine a rules-based policy with a learner, what validates the hand-written clauses that trigger outright denials and the map that decides which requests reach each component?

A correct shield and measured learner cannot answer that question, because neither checks those inputs.

The paper audits deny clauses and routing rules to show how hand-built inputs can misstate which requests a learned access-control system rejects or measures.

The authors checked candidate deny clauses against the complete set of requests each policy grants, rather than relying on a sample. In two policies with explicit restrictions, many clauses from both the author and three independent language-model elicitors would deny granted requests.

Tracing counterexamples showed that most came from other rules, consistent with prose restrictions being narrower than the full policy.

For routing, tested cap-and-rank selections often retained only one kind of rule. The authors also compared rule routing with a learner on two error rates.

On E-Document, class-aware rules favored both errors over a class-balanced learner at its default threshold, with training labels noised at 0.15. But threshold tuning changed the false-permit comparison; on Workforce, the two error rates moved in opposite directions.

The deny-clause rates come from five public policies, with explicit restrictions in only two, and one author plus three language-model elicitors.

Routing results also depend on the policy and learner setup: threshold tuning changed the E-Document verdict, and the result did not replicate on Workforce.