Agentic Workflows for Extraction of Access Control Matrices from Policy Documents

Configuring access control on databases is a critical task that can be achieved by determining the intended access control permissions from a precise format, such as an access control matrix (ACM). However, database access control permissions are often expressed as parts of security policy documents. Currently, these permissions must be manually extracted as an access control matrix in order to correctly configure the intended access control permissions. To accurately automate this tedious extraction process over documents of varying structures, we envision an agentic workflow for training an ACM extraction agent. To this end, we identify ACM Extraction and ACM Comparison as key components of such a procedure, and develop LLM agents for these components. We generate a benchmark to train and evaluate ACM Extraction using a real-world security policy and systematic perturbations of it. We find that our ACM Extraction agent has near-perfect accuracy, indicating our proposed agentic workflow is likely to be highly accurate for documents similar to those in our benchmark. As future work, we identify the iterative addition of failure-mode-specific rules as a strategy that would generalize our agentic workflow to broader classes of documents.