Pith. sign in

REVIEW 5 major objections 5 minor 35 references

"I Apologize For Not Understanding Your Policy": Exploring the Specification and Evaluation of User-Managed Access Control Policies by AI Virtual Assistants

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Current AI assistants cannot reliably enforce user-written access-control policies, the study argues: they answer direct questions well but fail exactly when a policy's deny-by-default clause must be applied to an unstated resource or role.

desk verdict A useful first pass at a real problem, but the numbers outrun the evidence and one protocol confound needs unpacking before you can trust the headline claim. read the letter →

arxiv 2505.07759 v1 pith:67OFTDKK submitted 2025-05-12 cs.AI

Jennifer Mondragon , Carlos Rubio-Medrano , Gael Cruz , Dvijesh Shastri This is my paper · ORCID
classification cs.AI
keywords user-managedaccesscontrolpoliciesvirtualassistantslargelanguagemodelsevaluationdefault-denyinferencesmarthomesecurityelectronichealthrecordsRBAC
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

An exploratory study of four publicly available AI assistants — ChatGPT (GPT-4o), Google Gemini, Microsoft Copilot, and Deepseek — asks whether they can take a user-written access-control policy and answer simple yes/no questions about who may use each device or record. The paper's central claim is that they cannot yet do this reliably: across smart-home, smart-car, and electronic-health-record scenarios, the assistants answered most direct questions correctly but systematically failed when a correct answer required inference, most notably applying a policy's 'everything else is denied' catch-all to a resource the policy never names. The authors argue this matters because these assistants are already marketed as natural-language controllers for smart locks, cars, and patient records, so a wrong inference is not a quiz error but a potential security or privacy breach. The study also finds that accuracy depends on how a policy is phrased and improves modestly in longer sessions, and it recommends integrating reasoning capabilities, domain-specific pre-training, and real-time adaptability into future assistants. Read sympathetically, the paper establishes that today's general-purpose assistants grasp the letter of a policy but not its deny-by-default logic.

What carries the argument

The load-bearing objects are the U-MAP encodings and the test protocol built around them. Each U-MAP is a role-based rule set derived from a subset of XACML with a single First-Applicable combining algorithm, and each is presented in three formats — Informal natural language, Semi-Formal enumerated statements, and Semi-Formal-Rule-Based code-like rules — plus 'modified' variants that change rules mid-session to test adaptation to dynamic updates. The decisive test element is the default-deny catch-all, 'everything else is denied,' paired with questions about unmentioned resources such as the meter in the smart-home policy, because answering requires the assistant to infer that an unnamed item falls under the catch-all. The protocol contrasts a Contextual method, which primes the assistant with an explanation of RBAC and domain security considerations, against a Non-Contextual cold-start method, and every answer is scored against researcher-established ground truth. Accuracy on the five questions per domain, aggregated across formats and sessions, is the metric that carries the argument.

What would settle it

Run the inference battery at scale on the current versions of the same assistants: build 50 to 100 access-request questions per domain whose correct answer requires applying a deny-by-default catch-all to a resource or role the policy never names, and score them against ground truth. If accuracy on those implicit-denial questions exceeds roughly 95%, or if asking the assistant to cite the rule that justified a denial consistently yields correct rule references, the paper's claim of a systematic inference failure would be refuted. A cheaper spot check: re-ask the smart-home 'homeowner and the meter' question in the Informal format on all four assistants today and compare the answers with the failures recorded in the paper.

Watch

Extended reading notes

Core claim

Stated on the paper's own terms, the discovery is that the failure point in AI-managed access control is not retrieval but entailment. With ground-truth answers defined by role-based policies adapted from XACML, the four assistants scored from roughly 60% to 100% accuracy depending on assistant, domain, policy format, and whether the session supplied context; the smart-car domain produced the largest drops. The most consistent failure was the inference question: when a policy said 'everything else is denied' and a request named an unlisted resource (for example, whether a homeowner may access a meter), one or more assistants answered affirmatively, declared themselves unable to determine, or apologized rather than concluding 'denied.' Longer sessions that restated and modified the rules lifted every assistant's average accuracy, and structured semi-formal formats slightly outperformed natural-language prose, while code-like rule formats showed the widest variance. The paper concludes that, at the time of testing, these models lacked the reasoning framework needed to enforce deny-by-default semantics, and that deploying them as policy enforcement points would introduce vulnerabilities that stem from inference failure rather than from user error.

Load-bearing premise

The accuracy numbers assume that five researcher-written questions per domain, applied to the specific policy wordings in the paper's tables, fairly represent how real users phrase policies and requests; without evidence that this tiny test set spans the variation found in actual deployments, the measured failure rates may not carry over to differently phrased policies.

Editorial extensions

If this is right

  • Deploying a general-purpose assistant as the enforcement point for a user-managed policy is unsafe for deny-by-default cases: a request about any resource or role the policy does not name has a measurable chance of being granted rather than denied, so security-sensitive devices such as smart locks should not rely on an assistant's interpretation alone.
  • Policy phrasing changes outcomes: semi-formal enumerated statements yielded slightly higher accuracy than informal natural language, and code-like rule formats produced the widest accuracy spread, so presenting rules as explicit enumerated statements is the safer way to hand a policy to an assistant.
  • Restating and updating rules during a session improves adherence across all four assistants, implying that interactive re-affirmation of a policy helps, though the improvements did not bring any assistant to a level suitable for security-critical access decisions.
  • Assistant behavior tracks how well documented a domain is in training data: the electronic-health-records domain, where access control is extensively documented, produced the highest scores, while smart cars, with scarce security documentation, produced the lowest, so domain-specific pre-training material is a direct lever on policy-handling accuracy.
  • Adding an explicit reasoning step improves answer quality but costs usability, as Deepseek's roughly 14-second average response time demonstrates, so the paper treats reasoning integration as a trade-off against response time rather than a free win.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the measured failure rates are likely a lower bound on deployment risk, because the test policies were short, single-combining-rule sets with no corner cases — a limitation the paper itself concedes — and realistic policies with multi-rule ordering and overlapping conditions would multiply the number of implicit-denial decisions.
  • My inference: the paper's design can be compressed into a lasting regression test for model releases, since the handful of 'unstated resource under default-deny' questions costs almost nothing to re-run each time an assistant updates and would give vendors a concrete signal on whether deny-by-default reasoning has improved.
  • My inference: the apology phrase that titles the paper suggests the models partly detect their own uncertainty; a testable extension is to check whether hedging or apologizing is actually predictive of a wrong answer, which would let a wrapper system escalate uncertain responses to a deterministic policy evaluator.
  • My inference: the same inference machinery will be stressed harder by attribute-based policies, which the paper names as future work, since conditions involving time, location, or relationship multiply the cases in which a resource is governed by negation or default; ABAC-style policies are a natural place to look for even larger failure gaps.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper presents an exploratory study of four commercial LLM-based virtual assistants (ChatGPT/GPT-4o, Google Gemini, Microsoft Copilot, and High-Flyer Deepseek) and their ability to interpret and apply user-managed access control policies (U-MAPs) in smart home, smart car, and electronic health record scenarios. The authors define several policy encodings (informal natural language, semi-formal unrolled statements, semi-formal rule-based, and a formal XACML subset) and test each VA under a contextual prompting protocol and a non-contextual protocol, using five access-request questions per domain. The main reported outcome is that the VAs handle explicitly stated rules reasonably well but consistently fail on inference-based questions that require applying a default-deny clause to resources or roles not named in the policy. The paper also reports format-dependent accuracy variation, discusses usability aspects such as response time and message limits, and offers recommendations for future VAs. The central qualitative claim—that inference and default-deny are hard for these systems—is plausible and worth investigating, but the quantitative accuracy figures are not backed by sufficient experimental detail.

Significance. If the central finding holds, it has practical security implications: using a general-purpose VA as an enforcement point for user-managed policies could allow unintended access, especially when policies rely on unstated denials. The paper is among the first to probe U-MAP comprehension in commercial VAs, and the selection of four assistants across three high-stakes domains is a reasonable starting point. Credit is due for publishing the actual policy encodings and question sets in Tables 1–4 and for including a sample per-question table in Appendix A. The qualitative observation in §5.4, such as the homeowner/meter example, is more convincing than the aggregate percentages in Figures 2 and 3. However, the significance is currently limited by the small, non-randomized question set, the absence of error bars or inter-rater agreement, and the contextual-protocol confound described below. The paper should be reframed as a qualitative, hypothesis-generating investigation, or the quantitative evaluation must be substantially strengthened.

major comments (5)
  1. [§4.5.1] The Contextual Method contains a direct confound that undermines the accuracy measurements. Step (3) instructs the VA to generate its own 'sample RBAC-like U-MAP' from instructions, and step (4) then scores the Table 2 questions against ground truth values derived from the intended U-MAP. If the VA generates a policy that differs from the intended one, a 'wrong' answer can be correct under the policy actually in force during that session. The paper provides no transcripts or VA-generated policies to rule out this possibility. Since the contextual condition contributes to all aggregate accuracy figures in Figures 2 and 3, and to the inference-failure claim in §5.4, this is a load-bearing methodological issue. The authors should either supply the generated policies and demonstrate that they match the intended U-MAPs, or restrict quantitative claims to the non-contextual condition where this confound does not arise.
  2. [§4.3, Tables 1, 3, 4] The different encodings of the supposedly same U-MAP are not semantically equivalent across formats, which invalidates the format-level accuracy comparisons. In the Smart Car domain, the Informal format (Table 3) states 'Only drivers should be allowed to give driving directions,' implying a default deny for non-drivers, while the Semi-Formal format states 'Everything else is Allowed' and the Semi-Formal-Rule-Based format states 'Default Radio & Directions & Settings = approved.' These are contradictory defaults, so a VA answering 'yes, kids can give directions' under the Semi-Formal or Rule-Based policy would be correct under that policy but marked wrong under the researchers' ground truth. Similar inconsistencies appear in the EHR encodings, where the Informal format restricts PII access to 'Admin Staff' but the Modified Semi-Formal-Rule-Based version grants PII access to 'Staff' and 'First Responders' without an explicit modification step. The paper must either make the formats semantically equivalent or treat each format as a distinct policy with its own ground truth; otherwise, the accuracy differences across formats in §5.3 and Figures 2–3 are uninterpretable.
  3. [§4.4, §5.1, Figures 2–3, Table 5] The quantitative claims rest on a very small sample that is not statistically characterized. Each domain has only five questions (Table 2), yet accuracy is reported to one or two decimal places with no confidence intervals, no error bars, and no inter-rater agreement calculation for the three researchers who conducted the sessions. With n=5 per condition, a single changed response shifts accuracy by 20 percentage points, so the differences described in §5.3 (e.g., 66.67% vs. 100% on a format) are not interpretable. Moreover, Table 5 provides per-question marks only for Smart Homes, and the caption does not define what the '×' marker means; no equivalent per-question data are supplied for Smart Cars or EHRs. The paper should provide the full per-question response matrix for all domains, a clear scoring legend, and appropriate uncertainty measures, or it should explicitly label all percentages as illustrative and drop the comparative claims.
  4. [§5.1, §4.3.2, Figure 2] There are internal inconsistencies in the reported numbers that need correction. Section 5.1 states that ChatGPT's lowest accuracy is 80% in the Smart Car domain, but the Smart Car panel of Figure 2 shows a 60% value in the ChatGPT row. Section 5.2's averages (e.g., 93.34%, 96.11%) are not derivable from the per-domain values in Figures 2–3 because the aggregation formula is unspecified. In addition, §4.3.2 states that the Formal XACML format 'was not used directly in the procedures,' yet Figures 2 and 3 include bars labeled 'Formal (w/ Context)' and 'Formal (w/o Context).' The authors should correct the numbers, specify exactly how the averages are computed, and clarify which formats the figure legend actually refers to.
  5. [§4.4, §5.4] The scoring rule for inference-based questions is not specified precisely enough to support the central claim. The paper states that responses were 'recorded as true or false' and that correctness was determined by comparing the VA's response to 'the explicit policy statement,' but it does not say how 'cannot determine' responses were counted, nor does it report inter-rater reliability for the more subjective cases such as Q-SM-5 ('Can Homeowner access a Meter?'). Since the default-deny inference is the paper's headline finding, the authors should define the full scoring rubric, state how indeterminate answers were handled, and provide the raw question-by-question labels for all VAs and domains.
minor comments (5)
  1. [Abstract] The phrase 'By conducting unstructured to structured tests' is unclear; the study actually uses two prompting methods (contextual and non-contextual) across several policy formats, so the wording should be aligned with the methodology.
  2. [§1, RQ1] In the research questions, 'V As' appears with an extra space; it should read 'VAs' for consistency with the rest of the paper.
  3. [References] Several references have garbled author names, e.g., references [6] and [7] begin with 'Chung, David Ferraiolo, and David Kuhn' without a clear first author, and reference [7] omits the year and conference details. These need to be cleaned up before publication.
  4. [§5.6.2] The claim that EHR-domain accuracy is higher because 'the widespread use of access control within the healthcare field' provides training data is presented without evidence; it is speculative and should be labeled as a hypothesis rather than a conclusion.
  5. [Table 5] The table is titled 'Sample Results' and uses an '×' marker without a legend; even after a legend is added, the table should indicate whether blank cells are correct answers, unasked questions, or missing data.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: VA responses are measured against exogenous ground-truth U-MAPs.

full rationale

This paper is an empirical evaluation, not a derivation. The ground-truth U-MAPs are fixed exogenously by the researchers before any VA interaction (Tables 1, 3, and 4, with the XACML/Informal/Semi-Formal encodings described in Sec. 4.3). The access-request questions in Table 2 are predefined, and correctness is determined by comparing VA responses to these external policies: Sec. 4.4 states 'Correctness was determined by comparing the VAs response to the explicit policy statement,' and Sec. 4.5.2 says responses are 'compared against ground truth values.' The accuracy figures in Figs. 2 and 3 are therefore measured performance statistics, not outputs forced by the input construction. There is no fitted parameter renamed as a prediction, no uniqueness theorem imported from the authors' prior work, and no load-bearing self-citation; citations such as RBAC [22] and XACML [26] provide background formalism but do not determine the empirical outcome. The only potential concern is the contextual method's step 3-4, where the VA generates a sample U-MAP before being asked the Table 2 questions; if the VA's generated policy differs from the intended policy, some 'wrong' answers might be correct under the VA's own policy. That is a protocol-validity limitation, acknowledged indirectly by the paper's Sec. 6 simplifications, but it is not circularity: the paper's claims describe how VAs behave under the stated protocol, and the measured responses are not derived from the ground truth by construction. No circular step can be identified, so the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new mathematical objects or fitted parameters. Its contribution is an empirical measurement, and the ledger below records the methodological assumptions on which that measurement rests.

assumptions (4)
  • domain assumption The four selected VAs (ChatGPT, Gemini, Copilot, Deepseek) are representative of the class of publicly available general-purpose virtual assistants.
    Sec 4.1 argues popularity and broad training make them ideal candidates, but no sampling frame or justification establishes that results generalize to other VAs or future model versions.
  • domain assumption The ground truth answers for the access request questions, as determined by the researchers, are the correct interpretations of the U-MAPs.
    Sec 4.4 states responses were compared against ground truth values, but ground truth is derived from the authors' own reading of the policies, not from an external standard or inter-rater validation.
  • domain assumption The three research team members who interacted with the VAs collected responses in a consistent, unbiased manner, and the two expert reviewers scored them reliably.
    Sec 4.5 describes the process but does not report inter-rater reliability or a scoring rubric; variability in interpreting free-form VA answers could affect the accuracy numbers.
  • domain assumption A five-question per-domain test set yields a stable estimate of VA accuracy.
    Sec 4.4 constructs only five questions per domain; the paper reports percentages to two significant figures (e.g., 93.33%) without confidence intervals, treating a 5-question sample as a reliable denominator. This is a statistical assumption that is not defended.

how reviews work

0 comments
Cite this review

Pith. "Pith review of "I Apologize For Not Understanding Your Policy": Exploring the Specification and Evaluation of User-Managed Access Control Policies by AI Virtual Assistants." pith.science (2026). https://pith.science/paper/67OFTDKK

@misc{pith2026250507759,
  author       = {Pith},
  title        = {Pith review of: "I Apologize For Not Understanding Your Policy": Exploring the Specification and Evaluation of User-Managed Access Control Policies by AI Virtual Assistants},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/67OFTDKK}},
  note         = {Machine review of arXiv:2505.07759}
}
read the original abstract

The rapid evolution of Artificial Intelligence (AI)-based Virtual Assistants (VAs) e.g., Google Gemini, ChatGPT, Microsoft Copilot, and High-Flyer Deepseek has turned them into convenient interfaces for managing emerging technologies such as Smart Homes, Smart Cars, Electronic Health Records, by means of explicit commands,e.g., prompts, which can be even launched via voice, thus providing a very convenient interface for end-users. However, the proper specification and evaluation of User-Managed Access Control Policies (U-MAPs), the rules issued and managed by end-users to govern access to sensitive data and device functionality - within these VAs presents significant challenges, since such a process is crucial for preventing security vulnerabilities and privacy leaks without impacting user experience. This study provides an initial exploratory investigation on whether current publicly-available VAs can manage U-MAPs effectively across differing scenarios. By conducting unstructured to structured tests, we evaluated the comprehension of such VAs, revealing a lack of understanding in varying U-MAP approaches. Our research not only identifies key limitations, but offers valuable insights into how VAs can be further improved to manage complex authorization rules and adapt to dynamic changes.

Figures

Figures reproduced from arXiv: 2505.07759 by the authors.

Figure 1
Figure 1. Contextual and Non-Contextual Approach Steps [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Overall Session Accuracy for Specific Domains (Smart Home, Smart Car, Electronic Health Records) - With and [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Overall Session Accuracy, Pre-Modified Session Accuracy, & Post-Modified Session Accuracy for All Scenarios(Smart [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 24 canonical work pages

  1. [1]

    Android Authority. 2024. Siri vs Alexa vs Google Assistant vs Bixby: Which one reigns supreme? https://www.androidauthority.com/siri-vs-alexa-vs-google- assistant-vs-bixby-3192996/. [Online; accessed September-12-2024]

    work page 2024

  2. [2]

    Fabio Arena, Giovanni Pau, and Alessandro Severino. 2020. An overview on the current status and future perspectives of smart cars. Infrastructures 5, 7 (2020), 53

    work page 2020

  3. [3]

    Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, et al . 2024. A survey on evaluation of large language models. ACM Transactions on Intelligent Systems and Technology 15, 3 (2024), 1–45

    2024

  4. [4]

    OpenAI ChatGPT. 2022. Introducing ChatGPT. https://openai.com/index/ chatgpt/

    work page 2022

  5. [5]

    Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374 (2021)

    arXiv 2021

  6. [6]

    Chung, David Ferraiolo, and David Kuhn. 2006. Assessment of Access Control Systems. https://doi.org/10.6028/NIST.IR.7316

    work page doi:10.6028/nist.ir.7316 2006

  7. [7]

    Chung, David Ferraiolo, David Kuhn, Adam Schnitzer, Kenneth Sandlin, Robert Miller, and Karen Scarfone. 2019. Guide to Attribute Based Access Control (ABAC) Definition and Considerations. https://tsapps.nist.gov/publication/get_ pdf.cfm?pub_id=927500

    work page 2019

  8. [8]

    Microsoft Copilot. 2025. Empower your organization with Copilot. https: //www.microsoft.com/en-us/microsoft-copilot/organizations

    work page 2025

Show all 35 references
  1. [9]

    Xin Luna Dong, Seungwhan Moon, Yifan Ethan Xu, Kshitiz Malik, and Zhou Yu

  2. [10]

    Jide S Edu, Jose M Such, and Guillermo Suarez-Tangil. 2020. Smart home personal assistants: a security and privacy review. ACM Computing Surveys (CSUR) 53, 6 (2020), 1–36

    2020

  3. [11]

    R Scott Evans. 2016. Electronic health records: then, now, and in the future. Yearbook of medical informatics 25, S 01 (2016), S48–S61

    2016

  4. [12]

    Fortune. 2024. Apple, Google, and Amazon May Have Violated Your Privacy by Reviewing Digital Assistant Commands. https://fortune.com/2019/08/05/google- apple-amazon-digital-assistants/. [Online; accessed September-12-2024]. Exploring the Evaluation of User-Managed Access Contr...

    2024

  5. [13]

    Google Gemini. 2023. Introducing Gemini: our largest and most capable AI model. https://blog.google/technology/ai/google-gemini-ai/#sundar-note

    2023

  6. [14]

    Jacopo Guanetti, Yeojun Kim, and Francesco Borrelli. 2018. Control of connected and automated vehicles: State of the art and future challenges. Annual reviews in control 45 (2018), 18–40

    2018

  7. [15]

    Umar Iqbal, Tadayoshi Kohno, and Franziska Roesner. 2023. LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI’s ChatGPT Plugins. arXiv preprint arXiv:2309.10254 (2023)

    2023 arXiv

  8. [16]

    Enkelejda Kasneci, Kathrin Seßler, Stefan Küchemann, Maria Bannert, Daryna Dementieva, Frank Fischer, Urs Gasser, Georg Groh, Stephan Günnemann, Eyke Hüllermeier, et al. 2023. ChatGPT for good? On opportunities and challenges of large language models for education. Learning an...

    2023

  9. [17]

    Yaa A Kumah-Crystal, Claude J Pirtle, Harrison M Whyte, Edward S Goode, Shilo H Anders, and Christoph U Lehmann. 2018. Electronic health record interactions through voice: a review. Applied clinical informatics 9, 03 (2018), 541–552

    2018

  10. [18]

    Song Liao, Christin Wilson, Long Cheng, Hongxin Hu, and Huixing Deng. 2020. Measuring the Effectiveness of Privacy Policies for Voice Assistant Applications. http://arxiv.org/abs/2007.14570

    2020 arXiv

  11. [19]

    Amarachi B Mbakwe, Ismini Lourentzou, Leo Anthony Celi, Oren J Mechanic, and Alon Dagan. 2023. ChatGPT passing USMLE shines a spotlight on the flaws of medical education. , e0000205 pages

    2023

  12. [20]

    Microsoft. 2024. Microsoft Trustworthy AI: Unlocking human potential starts with trust. https://blogs.microsoft.com/blog/2024/09/24/microsoft-trustworthy- ai-unlocking-human-potential-starts-with-trust/

    2024

  13. [21]

    Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt, and Ramesh Karri. 2022. Asleep at the keyboard? assessing the security of github copilot’s code contributions. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 754–768

    2022

  14. [22]

    R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman. 1996. Role-Based Access Control Models. Computer 29, 2 (Feb. 1996), 38–47

    1996

  15. [23]

    D. K. Smetters and Nathan Good. 2009. How users use access control. In Pro- ceedings of the 5th Symposium on Usable Privacy and Security (Mountain View, California, USA) (SOUPS ’09). Association for Computing Machinery, New York, NY, USA, Article 15, 12 pages. https://doi.org/...

    2009

  16. [24]

    Zhongxiang Sun. 2023. A short survey of viewing large language models in legal aspect. arXiv preprint arXiv:2303.09136 (2023)

    2023 arXiv

  17. [25]

    DeepSeek-AI Research Team. 2025. DeepSeek-V3 Technical Report. (February 2025). https://arxiv.org/pdf/2412.19437

    2025 arXiv

  18. [26]

    Fatih Turkmen, Jerry den Hartog, Silvio Ranise, and Nicola Zannone. 2017. Formal analysis of XACML policies using SMT. Computers & Security 66 (2017), 185–203. https://doi.org/10.1016/j.cose.2017.01.009

    2017 doi

  19. [27]

    Chris Varner. 2025. Understanding Different ChatGPT Models: Key Details to Consider. https://teamai.com/blog/large-language-models-llms/understanding- different-chatgpt-models/

    2025

  20. [28]

    As an AI language model, I cannot

    Joel Wester, Tim Schrills, Henning Pohl, and Niels van Berkel. 2024. “As an AI language model, I cannot”: Investigating LLM Denials of User Requests. In Proceedings of the CHI Conference on Human Factors in Computing Systems . 1–14

    2024

  21. [29]

    Binwei Yao, Ming Jiang, Diyi Yang, and Junjie Hu. 2023. Benchmarking llm- based machine translation on cultural awareness. arXiv preprint arXiv:2305.14328 (2023)

    2023 arXiv

  22. [30]

    Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing (2024), 100211. Mondragon et al. 8 APPENDIX A: USER-MANAGED ACCESS CONTROL PO...

    2024

  23. [32]

    Co-Pilots cannot give Directions,

  24. [33]

    Passengers cannot give Directions, ... 4. Everything else is Allowed. Modified Semi-Formal (Mod-SEMI-UNROLL) Create new Rule: Kids cannot give Directions; Remove Rule: Co-Pilots cannot give Directions Semi-Formal- Rule-Based (SEMI-RULE) if Role = Co-Pilot: Directions = denied,...

  25. [34]

    Physicians can access Medical Data,

  26. [35]

    First Responders can access PII- Data

    Nurses can access Medical Data, ... 9. Everything else is denied. Modified Semi-Formal (Mod-SEMI-UNROLL) Create new Rule: "First Responders can access PII- Data"; Remove Rule: "First Responders cannot access PII-Data"; Create new Rule: "Staff can access Medical Data" Semi-Form...

  27. [2023]

    In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining

    Towards next-generation intelligent assistants leveraging llm techniques. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 5792–5793

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.