Cloud compute systems allow administrators to write access control policies that govern access to private data. While policies are written in convenient languages, such as AWS Identity and Access Management Policy Language, manually written policies often become complex and error prone. In this paper, we investigate whether and how well Large Language Models (LLMs) can be used to synthesize access control policies. Our investigation focuses on the task of taking an access control request specification and zero-shot prompting LLMs to synthesize a well-formed access control policy which correctly adheres to the request specification. We consider two scenarios, one which the request specification is given as a concrete list of requests to be allowed or denied, and another in which a natural language description is used to specify sets of requests to be allowed or denied. We then argue that for zero-shot prompting, more precise and structured prompts using a syntax based approach are necessary and experimentally show preliminary results validating our approach.

本研究解决了云计算系统中手动编写访问控制策略所带来的复杂性和错误问题。我们提出了一种使用大型语言模型零-shot提示生成符合请求规范的访问控制策略的新方法，并验证了需要更精确和结构化的语法提示。实验结果初步证明了该方法的有效性，对提升政策生成的准确性和可靠性有重要影响。

利用大型语言模型合成访问控制策略