Combinatorial Allocation Bandits with Nonlinear Arm Utility

Koichi Tanaka; Shinji Ito; Yuki Shibukawa; Yuta Saito

REVIEW 3 major objections 2 minor 17 references

A new bandit problem treats matching-platform fairness as arm satisfaction, not raw match count, and still gets near-optimal regret.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-15 13:31 UTC pith:OS3AZAWU

load-bearing objection We only have a coherent abstract for CAB; the attached full text is a different paper (healthcare CBAC), so the regret claims cannot be audited at all. the 3 major comments →

arxiv 2603.07005 v2 pith:OS3AZAWU submitted 2026-03-07 cs.LG stat.ML

Combinatorial Allocation Bandits with Nonlinear Arm Utility

Yuki Shibukawa , Koichi Tanaka , Yuta Saito , Shinji Ito This is my paper

classification cs.LG stat.ML

keywords combinatorial banditscontextual banditsarm satisfactionmatching platformsgeneralized linear modelupper confidence boundThompson samplingapproximate regret

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Matching platforms that only maximize successful matches tend to overload popular participants, breed dissatisfaction, and drive churn. This paper defines Combinatorial Allocation Bandits (CAB) so that each round the learner sees feature vectors for arms and users, assigns users to arms, receives generalized-linear-model feedback, and is scored on arm satisfaction rather than total positive outcomes. It supplies an upper-confidence-bound algorithm that calls an approximate combinatorial oracle and proves an approximate regret bound whose dependence on dimension, horizon, and number of users matches the known lower bound for contextual combinatorial linear bandits up to logs. A Thompson-sampling algorithm is also analyzed under an exact oracle, together with a cheaper one-pass variant that keeps sublinear approximate regret under a self-concordance assumption. Synthetic experiments show the UCB method accumulates higher satisfaction than baselines that ignore the satisfaction objective.

Core claim

The authors establish that the CAB objective—maximizing arm satisfaction under GLM feedback and combinatorial assignment—admits an approximate UCB algorithm whose regret scales with d, T and N essentially as tightly as the best known rates for ordinary contextual combinatorial linear bandits, provided an approximate optimization oracle is available.

What carries the argument

CAB-UCB: an upper-confidence-bound policy that repeatedly invokes an approximate combinatorial optimization oracle to select user-to-arm assignments that maximize optimistic arm-satisfaction scores; the resulting approximate regret is shown to match the contextual combinatorial linear lower bound up to logarithmic factors.

Load-bearing premise

Feedback must follow a generalized linear model of the observed features, and the learner must have access to a combinatorial optimization oracle that can (approximately) solve the assignment step each round.

What would settle it

Run the same synthetic (or real matching) workloads with deliberately misspecified non-GLM reward generation or with a deliberately poor approximate oracle; if CAB-UCB’s cumulative satisfaction advantage and the claimed regret scaling both disappear, the central claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

Platforms can optimize long-term participant retention instead of short-term match volume while still enjoying theoretically grounded online learning guarantees.
Any approximate combinatorial solver that is already used for offline matching can be plugged in as the oracle and immediately yields a near-optimal online algorithm.
The one-pass Thompson-sampling variant makes the same satisfaction objective practical when full posterior sampling is too expensive.
Regret bounds that previously applied only to linear combinatorial bandits now transfer, up to logs, to a nonlinear satisfaction objective under the GLM model.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same satisfaction-centric objective could be ported to other two-sided markets (ride-hailing, tutoring, advertising inventory) where churn of the “arm” side is the true economic risk.
If real platforms already compute approximate matchings each second, the oracle assumption is essentially free, turning the theoretical result into an immediately deployable policy layer.
Self-concordance for the one-pass TS variant suggests that many common link functions already used in click models may automatically unlock the cheaper algorithm.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

We only have a coherent abstract for CAB; the attached full text is a different paper (healthcare CBAC), so the regret claims cannot be audited at all.

read the letter

The one thing you need to know: the abstract for Combinatorial Allocation Bandits looks like a clean, scoped contribution, but the full manuscript we were given is an unrelated consent-based access control paper (2603.07004). So every load-bearing claim—approximate regret matching the contextual combinatorial linear lower bound in d, T, N, the oracle reductions, the one-pass TS under self-concordance—is currently uncheckable.

What is actually new, on the abstract alone: they reframe matching-platform learning around arm satisfaction rather than raw positive feedback, under combinatorial assignment and GLM feedback. That is a real problem statement, not a relabeling of standard combinatorial bandits. They claim a UCB-style algorithm with an approximate optimization oracle whose approximate regret dependence matches known lower bounds up to logs, plus a standard TS analysis under an exact oracle and a cheaper one-pass TS variant. Synthetic experiments are said to favor CAB-UCB on cumulative satisfaction. As a formulation-plus-analysis package, that is the right shape of contribution for this literature.

Soft spots, in proportion: the softest spot is not a flaw in the abstract—it is the missing paper. Without theorems, oracle definitions, link-function assumptions, and experiment details, soundness is unknown. From the abstract, the usual caveats apply: GLM feedback, access to a combinatorial oracle, and self-concordance for the cheap TS variant are baked into the guarantees; evaluation is synthetic only. None of that is damning if the full analysis is standard and careful; we just cannot tell.

Who it is for: people already working on contextual combinatorial bandits and marketplace matching who care about fairness/satisfaction rather than pure match count. The abstract is coherent enough that a serious editor should send the real manuscript to referees rather than desk-reject on title alone. I would not cite or put this in reading group until we have the actual CAB paper. Get the right PDF; then re-read the regret proofs and the oracle approximation carefully.

Referee Report

3 major / 2 minor

Summary. The submission is identified as arXiv:2603.07005, Combinatorial Allocation Bandits (CAB) with Nonlinear Arm Utility. The abstract defines CAB as a contextual combinatorial bandit problem in which the learner assigns N users to K arms given feature vectors, receives GLM feedback, and optimizes arm satisfaction rather than match count. It claims a UCB algorithm using an approximate optimization oracle whose approximate regret matches known contextual combinatorial linear-bandit lower bounds in d, T, and N up to logs; a Thompson-sampling analysis under an exact oracle; a cheaper one-pass TS variant under self-concordance; and synthetic experiments favoring CAB-UCB on cumulative satisfaction. The full manuscript text supplied for review, however, is an unrelated paper (arXiv:2603.07004) on an extended Consent-Based Access Control framework with pre-commit validation (CCAM), system invariants, and emergency disclosure control (EDCF). No CAB definitions, oracles, regret proofs, or bandit experiments appear in the provided full text.

Significance. If the abstract claims were substantiated by correct proofs and reproducible experiments, the work would be a meaningful contribution to contextual combinatorial bandits: shifting the objective from cumulative reward to arm satisfaction is practically motivated for matching platforms, and matching known lower-bound dependence (up to logs) with an approximate oracle would be a strong technical result. Because the supplied full manuscript does not contain any of the CAB analysis, significance of the claimed results cannot be assessed from the materials under review.

major comments (3)

Title/abstract vs. full text mismatch: the document under review is the CBAC healthcare access-control paper (pre-commit CCAM, invariants Author(r)/Subject(r), EDCF, Sections 1–7, Tables 1–3, Figures 1–9), not a bandit paper. None of the CAB problem formalization, GLM likelihood, approximate/exact optimization oracles, UCB/TS regret theorems, self-concordance argument, or synthetic bandit experiments exist in the supplied manuscript. The central claims of the abstract are therefore unverifiable from the materials provided.
Even taking the abstract alone, the load-bearing technical claims (approximate regret matching the contextual combinatorial linear lower bound in d, T, N; standard TS regret under an exact oracle; one-pass TS sublinear approximate regret under self-concordance) rest on proofs, oracle interface definitions, and GLM regularity conditions that are absent. Without those, the dependence on the approximate oracle and the self-concordance assumption cannot be checked for gaps or incorrect reductions.
Experimental support is stated only as 'experiments on synthetic data' in the abstract. No experimental section, baselines, metrics, or figures for CAB appear in the supplied text, so the claim that CAB-UCB achieves higher cumulative satisfaction cannot be audited.

minor comments (2)

The abstract uses 'arm satisfaction' without a formal definition; if a corrected CAB manuscript is resubmitted, that quantity should be stated mathematically in the problem formulation.
The abstract asserts matching a 'known lower bound for contextual combinatorial linear bandits' without citing the specific lower-bound result; a resubmission should name the reference and state the precise dependence being matched.

Circularity Check

0 steps flagged

No circularity found: the supplied manuscript is a systems/architecture paper whose formal properties hold by design construction and whose empirical claims are direct synthetic measurements, not fitted-or-self-cited predictions.

full rationale

The CACHEABLE full text is the unrelated CBAC/XACML paper (pre-commit validation, system invariants, EDCF emergency disclosure), not the CAB bandit abstract. Within the supplied text there is no derivation chain that reduces a claimed prediction or first-principles result to its own inputs. System invariants (Section 4.1) are stipulated axioms; CCAM simply checks compliance with them before commit (Section 4.2). EDCF properties (determinism, bounded disclosure, consent non-interference, traceability in Section 5.2.2) are restated consequences of the explicit definitions of ESD, G and L_em; they are not presented as independent discoveries. Runtime latency and disclosure-ratio results (Section 6) are pure measurements on synthetic workloads with injected anomalies; no free parameters are fitted and then re-labeled as predictions. There are no load-bearing self-citations of uniqueness theorems, no ansatz smuggled via prior author work, and no renaming of known empirical patterns. The paper is therefore free of the circularity patterns enumerated in the analyzer instructions. (The CAB regret claims in the abstract cannot be audited at all because the corresponding proofs, oracles and experiments are absent from the supplied manuscript.)

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 1 invented entities

From the abstract only: the central claims rest on a GLM reward model, combinatorial assignment structure, availability of an (approximate) optimization oracle, and (for the cheap TS variant) self-concordance. No free parameters are numerically fitted in the abstract; invented entities are the CAB problem and the satisfaction objective rather than physical objects.

axioms (4)

domain assumption Observed feedback follows a generalized linear model (GLM) of arm and user feature vectors.
Stated as the observation model for CAB; all learning and regret claims depend on it.
domain assumption An approximate (or exact) combinatorial optimization oracle is available for the assignment step each round.
CAB-UCB uses an approximate oracle; TS analysis uses an exact oracle. Regret statements are relative to that oracle model.
ad hoc to paper Self-concordance holds for the one-pass Thompson sampling variant to retain sublinear approximate regret.
Abstract explicitly conditions the cheaper one-pass TS guarantee on a self-concordance assumption.
standard math Known lower bounds for contextual combinatorial linear bandits apply as the comparison baseline for d, T, N dependence.
The main UCB claim is that approximate regret matches those lower bounds up to logarithmic factors.

invented entities (1)

Combinatorial Allocation Bandits (CAB) with arm satisfaction objective no independent evidence
purpose: Replace match-count maximization with an objective that rewards arm-level satisfaction to mitigate churn of unpopular participants.
Core problem definition introduced in the abstract; independent evidence would require real-platform validation beyond synthetic experiments.

pith-pipeline@v1.1.0-grok45 · 21735 in / 2424 out tokens · 26810 ms · 2026-07-15T13:31:50.080153+00:00 · methodology

0 comments

read the original abstract

A matching platform is a system that matches participants of different types, such as companies and job-seekers. In such a platform, maximizing matches may concentrate assignments on popular participants, increasing dissatisfaction among others, and eventually causing churn, which reduces the platform's profit opportunities. To address this issue, we propose a novel online learning problem, Combinatorial Allocation Bandits (CAB), which incorporates the notion of *arm satisfaction*. In CAB, at each round, the learner observes feature vectors for $K$ arms and $N$ users, assigns users to arms, and observes feedback following a generalized linear model (GLM). Unlike prior work, the objective is to maximize arm satisfaction rather than the number of positive feedback. For CAB, we develop an upper confidence bound algorithm that uses an approximate optimization oracle and achieves an approximate regret upper bound, whose dependence on $d$, $T$, and $N$ matches the known lower bound for contextual combinatorial linear bandits up to logarithmic factors. We also analyze a Thompson sampling algorithm with a standard regret bound under an exact optimization oracle, and propose a cheaper one-pass variant retaining sublinear approximate regret under a self-concordance assumption. Experiments on synthetic data support the objective and show that CAB-UCB achieves higher cumulative satisfaction than baselines.

discussion (0)

Reference graph

Works this paper leans on

17 extracted references · 2 canonical work pages

[1]

extensible access control markup language (XACML) version 3.0,

OASIS, “extensible access control markup language (XACML) version 3.0,” OASIS Standard, Tech. Rep., 2013. [Online]. Available: https://docs.oasis-open.org/xacml/3. 0/xacml-3.0-core-spec-os-en.html

2013
[2]

Sauwens, E

M. Sauwens, E. Heydari Beni, K. Jannes, B. Lagaisse, and W. Joosen,ThunQ: A Distributed and Deep Authorization Middleware for Early and Lazy Policy Enforcement in Microservice Applications. Cham: Springer International Publishing, 2021, pp. 204–220

2021
[3]

Verification and change-impact analysis of access-control policies,

K. Fisler, S. Krishnamurthi, L. A. Meyerovich, and M. C. Tschantz, “Verification and change-impact analysis of access-control policies,” inProceedings of the 27th international conference on Software engineering - ICSE ’05. St. Louis, MO, USA: ACM Press, 2005, p. 196. [Online]. Available: http://portal.acm.org/citation.cfm? doid=1062455.1062502

arXiv 2005
[4]

Discovery and Resolution of Anomalies in Web Access Control Policies,

H. Hu, G.-J. Ahn, and K. Kulkarni, “Discovery and Resolution of Anomalies in Web Access Control Policies,”IEEE Transactions on Dependable and Secure Computing, vol. 10, no. 6, pp. 341–354, Nov. 2013. [Online]. Available: http://ieeexplore.ieee.org/document/6482139/

arXiv 2013
[5]

Consent-based access control for secure and privacy-preserving health information exchange: Consent-based access control for health information exchange,

A. Zhang, A. Bacchus, and X. Lin, “Consent-based access control for secure and privacy-preserving health information exchange: Consent-based access control for health information exchange,”Security and Communication Networks, vol. 9, no. 16, pp. 3496–3508, Nov. 2016. [Online]. Available: https://onlinelibrary.wiley.com/doi/10. 1002/sec.1556 28

2016
[6]

Formal models for consent-based privacy,

N. Peyrone and D. Wichadakul, “Formal models for consent-based privacy,”Journal of Logical and Algebraic Methods in Programming, vol. 128, p. 100789, Aug. 2022. [Online]. Available: https://linkinghub.elsevier.com/retrieve/pii/S2352220822000426

2022
[7]

A Consent Model for Blockchain-Based Health Data Sharing Platforms,

V. Jaiman and V. Urovi, “A Consent Model for Blockchain-Based Health Data Sharing Platforms,”IEEE Access, vol. 8, pp. 143 734–143 745, 2020. [Online]. Available: https://ieeexplore.ieee.org/document/9159120/

arXiv 2020
[8]

Toward an Interoperable and Centralized Consent Centric Access Control Model for Healthcare Resources: Model and Implementation,

H. Mousaid, “Toward an Interoperable and Centralized Consent Centric Access Control Model for Healthcare Resources: Model and Implementation,” Thesis, Sep. 2020, accessed: 2026-02-04. [Online]. Available: http://hdl.handle.net/10012/16408

2020
[9]

Exploring Large Language Models for Access Control Policy Synthesis and Summarization,

A. Vatsa, B. Hall, and W. Eiers, “Exploring Large Language Models for Access Control Policy Synthesis and Summarization,” 2025. [Online]. Available: https://arxiv.org/abs/2510.20692

Pith/arXiv arXiv 2025
[10]

SoK: Access Control Policy Generation from High-level Natural Language Requirements,

S. H. Jayasundara, N. A. Gamagedara Arachchilage, and G. Russello, “SoK: Access Control Policy Generation from High-level Natural Language Requirements,” ACM Computing Surveys, vol. 57, no. 4, pp. 1–37, Apr. 2025. [Online]. Available: https://dl.acm.org/doi/10.1145/3706057

work page doi:10.1145/3706057 2025
[11]

From Plain English to XACML Policies: An AI-Based Pipeline Approach:,

M. Paratore, E. Marchetti, and A. Calabr` o, “From Plain English to XACML Policies: An AI-Based Pipeline Approach:,” inProceedings of the 13th International Conference on Model-Based Software and Systems Engineering. Porto, Portugal: SCITEPRESS - Science and Technology Publications, 2025, pp. 85–96. [Online]. Available: https://www.scitepress.org/DigitalL...

work page doi:10.5220/0013357200003896 2025
[12]

Translating Natural Language Specifications into Access Control Policies by Leveraging Large Language Models,

S. Lawal, X. Zhao, A. Rios, R. Krishnan, and D. Ferraiolo, “Translating Natural Language Specifications into Access Control Policies by Leveraging Large Language Models,” in2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA), Oct. 2024, pp. 361–370. [Online]. Available: https://ieeexplor...

arXiv 2024
[13]

FHIR Release 4 (R4): Fast Healthcare Interoperability Resources,

HL7 International, “FHIR Release 4 (R4): Fast Healthcare Interoperability Resources,” Online, 2019, accessed: 2026-01-01. [Online]. Available: https://www.hl7.org/fhir/

2019
[14]

Privacy-aware relationship semantics–based XACML access control model for electronic health records in hybrid cloud,

T. Kanwal, A. A. Jabbar, A. Anjum, S. U. Malik, A. Khan, N. Ahmad, U. Manzoor, M. N. Shahzad, and M. A. Balubaid, “Privacy-aware relationship semantics–based XACML access control model for electronic health records in hybrid cloud,”International Journal of Distributed Sensor Networks, vol. 15, no. 6, p. 155014771984605, Jun. 2019. [Online]. Available: htt...

2019
[15]

Lightweight Break-Glass Access Control System for Healthcare Internet-of-Things,

Y. Yang, X. Liu, and R. H. Deng, “Lightweight Break-Glass Access Control System for Healthcare Internet-of-Things,”IEEE Transactions on Industrial 29 Informatics, vol. 14, no. 8, pp. 3610–3617, Aug. 2018. [Online]. Available: https://ieeexplore.ieee.org/document/8036213/

arXiv 2018
[16]

AuthzForce: An open-source xacml 3.0 policy decision point,

AuthzForce Team, “AuthzForce: An open-source xacml 3.0 policy decision point,” GitHub repository, 2024, accessed: 2026-01-01. [Online]. Available: https://github.com/authzforce/core

2024
[17]

cbac-precommit-emergency-eval: Evaluation code and datasets for pre-commit consent validation and emergency access,

nasif2005, “cbac-precommit-emergency-eval: Evaluation code and datasets for pre-commit consent validation and emergency access,” GitHub repository, 2026, accessed: 2026-02-01. [Online]. Available: https://github.com/nasif2005/ cbac-precommit-emergency-eval 30 �� ...

2026

[1] [1]

extensible access control markup language (XACML) version 3.0,

OASIS, “extensible access control markup language (XACML) version 3.0,” OASIS Standard, Tech. Rep., 2013. [Online]. Available: https://docs.oasis-open.org/xacml/3. 0/xacml-3.0-core-spec-os-en.html

2013

[2] [2]

Sauwens, E

M. Sauwens, E. Heydari Beni, K. Jannes, B. Lagaisse, and W. Joosen,ThunQ: A Distributed and Deep Authorization Middleware for Early and Lazy Policy Enforcement in Microservice Applications. Cham: Springer International Publishing, 2021, pp. 204–220

2021

[3] [3]

Verification and change-impact analysis of access-control policies,

K. Fisler, S. Krishnamurthi, L. A. Meyerovich, and M. C. Tschantz, “Verification and change-impact analysis of access-control policies,” inProceedings of the 27th international conference on Software engineering - ICSE ’05. St. Louis, MO, USA: ACM Press, 2005, p. 196. [Online]. Available: http://portal.acm.org/citation.cfm? doid=1062455.1062502

arXiv 2005

[4] [4]

Discovery and Resolution of Anomalies in Web Access Control Policies,

H. Hu, G.-J. Ahn, and K. Kulkarni, “Discovery and Resolution of Anomalies in Web Access Control Policies,”IEEE Transactions on Dependable and Secure Computing, vol. 10, no. 6, pp. 341–354, Nov. 2013. [Online]. Available: http://ieeexplore.ieee.org/document/6482139/

arXiv 2013

[5] [5]

Consent-based access control for secure and privacy-preserving health information exchange: Consent-based access control for health information exchange,

A. Zhang, A. Bacchus, and X. Lin, “Consent-based access control for secure and privacy-preserving health information exchange: Consent-based access control for health information exchange,”Security and Communication Networks, vol. 9, no. 16, pp. 3496–3508, Nov. 2016. [Online]. Available: https://onlinelibrary.wiley.com/doi/10. 1002/sec.1556 28

2016

[6] [6]

Formal models for consent-based privacy,

N. Peyrone and D. Wichadakul, “Formal models for consent-based privacy,”Journal of Logical and Algebraic Methods in Programming, vol. 128, p. 100789, Aug. 2022. [Online]. Available: https://linkinghub.elsevier.com/retrieve/pii/S2352220822000426

2022

[7] [7]

A Consent Model for Blockchain-Based Health Data Sharing Platforms,

V. Jaiman and V. Urovi, “A Consent Model for Blockchain-Based Health Data Sharing Platforms,”IEEE Access, vol. 8, pp. 143 734–143 745, 2020. [Online]. Available: https://ieeexplore.ieee.org/document/9159120/

arXiv 2020

[8] [8]

Toward an Interoperable and Centralized Consent Centric Access Control Model for Healthcare Resources: Model and Implementation,

H. Mousaid, “Toward an Interoperable and Centralized Consent Centric Access Control Model for Healthcare Resources: Model and Implementation,” Thesis, Sep. 2020, accessed: 2026-02-04. [Online]. Available: http://hdl.handle.net/10012/16408

2020

[9] [9]

Exploring Large Language Models for Access Control Policy Synthesis and Summarization,

A. Vatsa, B. Hall, and W. Eiers, “Exploring Large Language Models for Access Control Policy Synthesis and Summarization,” 2025. [Online]. Available: https://arxiv.org/abs/2510.20692

Pith/arXiv arXiv 2025

[10] [10]

SoK: Access Control Policy Generation from High-level Natural Language Requirements,

S. H. Jayasundara, N. A. Gamagedara Arachchilage, and G. Russello, “SoK: Access Control Policy Generation from High-level Natural Language Requirements,” ACM Computing Surveys, vol. 57, no. 4, pp. 1–37, Apr. 2025. [Online]. Available: https://dl.acm.org/doi/10.1145/3706057

work page doi:10.1145/3706057 2025

[11] [11]

From Plain English to XACML Policies: An AI-Based Pipeline Approach:,

M. Paratore, E. Marchetti, and A. Calabr` o, “From Plain English to XACML Policies: An AI-Based Pipeline Approach:,” inProceedings of the 13th International Conference on Model-Based Software and Systems Engineering. Porto, Portugal: SCITEPRESS - Science and Technology Publications, 2025, pp. 85–96. [Online]. Available: https://www.scitepress.org/DigitalL...

work page doi:10.5220/0013357200003896 2025

[12] [12]

Translating Natural Language Specifications into Access Control Policies by Leveraging Large Language Models,

S. Lawal, X. Zhao, A. Rios, R. Krishnan, and D. Ferraiolo, “Translating Natural Language Specifications into Access Control Policies by Leveraging Large Language Models,” in2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA), Oct. 2024, pp. 361–370. [Online]. Available: https://ieeexplor...

arXiv 2024

[13] [13]

FHIR Release 4 (R4): Fast Healthcare Interoperability Resources,

HL7 International, “FHIR Release 4 (R4): Fast Healthcare Interoperability Resources,” Online, 2019, accessed: 2026-01-01. [Online]. Available: https://www.hl7.org/fhir/

2019

[14] [14]

Privacy-aware relationship semantics–based XACML access control model for electronic health records in hybrid cloud,

T. Kanwal, A. A. Jabbar, A. Anjum, S. U. Malik, A. Khan, N. Ahmad, U. Manzoor, M. N. Shahzad, and M. A. Balubaid, “Privacy-aware relationship semantics–based XACML access control model for electronic health records in hybrid cloud,”International Journal of Distributed Sensor Networks, vol. 15, no. 6, p. 155014771984605, Jun. 2019. [Online]. Available: htt...

2019

[15] [15]

Lightweight Break-Glass Access Control System for Healthcare Internet-of-Things,

Y. Yang, X. Liu, and R. H. Deng, “Lightweight Break-Glass Access Control System for Healthcare Internet-of-Things,”IEEE Transactions on Industrial 29 Informatics, vol. 14, no. 8, pp. 3610–3617, Aug. 2018. [Online]. Available: https://ieeexplore.ieee.org/document/8036213/

arXiv 2018

[16] [16]

AuthzForce: An open-source xacml 3.0 policy decision point,

AuthzForce Team, “AuthzForce: An open-source xacml 3.0 policy decision point,” GitHub repository, 2024, accessed: 2026-01-01. [Online]. Available: https://github.com/authzforce/core

2024

[17] [17]

cbac-precommit-emergency-eval: Evaluation code and datasets for pre-commit consent validation and emergency access,

nasif2005, “cbac-precommit-emergency-eval: Evaluation code and datasets for pre-commit consent validation and emergency access,” GitHub repository, 2026, accessed: 2026-02-01. [Online]. Available: https://github.com/nasif2005/ cbac-precommit-emergency-eval 30 �� ...

2026