REVIEW 8 cited by
DePLOI: Applying NL2SQL to Synthesize and Audit Database Access Control
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
In every enterprise database, administrators must define an access control policy that specifies which users have access to which tables. Access control straddles two worlds: policy (organization-level principles that define who should have access) and process (database-level primitives that actually implement the policy). Assessing and enforcing process compliance with a policy is a manual and ad-hoc task. This paper introduces a new access control model called Intent-Based Access Control for Databases (IBAC-DB). In IBAC-DB, access control policies are expressed using abstractions that scale to high numbers of database objects, and are traceable with respect to implementations. This paper proposes DePLOI (Deployment Policy Linter for Organization Intents), a LLM-backed system leveraging access control-specific task decompositions to accurately synthesize and audit access control implementation from IBAC-DB abstractions. As DePLOI is the first system of its kind to our knowledge, this paper further proposes IBACBench, the first benchmark for evaluating the synthesis and auditing capabilities of DePLOI. IBACBench leverages a combination of current NL2SQL benchmarks, real-world role hierarchies and access control policies, and LLM-generated data. We find that DePLOI achieves high synthesis accuracies and auditing F1 scores overall, and greatly outperforms other LLM prompting strategies (e.g., by 10 F1 points).
Forward citations
Cited by 8 Pith papers
-
Benchmarking Text-to-SQL under Role-Based Access Control
RBAC-augmented versions of Spider, BIRD, and LiveSQLBench show many text-to-SQL models, open-weight ones especially, frequently emit unauthorized SQL despite high unrestricted-execution scores.
-
Neurosymbolic Characterization for Reliable Access Control Policy Analysis
PolicySummarizer generates a simplified, human-readable regular expression for the requests a cloud access-control policy allows, and uses automata-based model counting to check the simplification against the exact po...
-
LLM-Driven Auto Configuration for Transient IoT Device Collaboration
CollabIoT automatically generates validated fine-grained access control policies from natural language and configures transient IoT devices using capability tokens and proxy-based enforcement.
-
Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things
LACE is a hybrid LLM-RAG-OPA framework that generates and verifies natural-language IoT access-control policies and reports up to 88% decision accuracy in smart-home evaluations.
-
Authenticated Delegation and Authorized AI Agents
A framework extending OAuth 2.0 and OpenID Connect with agent-ID and delegation tokens so AI agents can act on behalf of verified humans with auditable, limited permissions.
-
Private, Verifiable, and Auditable AI Systems
A thesis demonstrating partial prototypes for zk-verifiable model evaluation and privacy-preserving retrieval, and arguing these pieces can compose into end-to-end auditable AI systems.
-
A Simple and Fast Way to Handle Semantic Errors in Transactions
An invariant-based middleware can coordinate buffered and new transactions to allow safe removal of erroneous LLM-generated transactions, at the cost of buffering dependent transactions.
-
LLM Harms: A Taxonomy and Discussion
This paper proposes a taxonomy of LLM harms in five categories and suggests mitigation strategies plus a dynamic auditing system for responsible development.
Discussion (0). Continue with ORCID to comment.