Leveraging Architectural Context in LLM-based Access Control Policy Generation for Microservices
Year: 2026
Type: conference-paper
Abstract: In a microservice architecture, services use access control policies to prevent being abused by external users and other (compromised) services. An emerging approach to implementing policies is Policy-as-Code (PaC), in which policies are defined, enforced, and managed via code. However, writing and maintaining the policies in PaC is complex, error-prone, and requires expertise in the PaC frameworks. Moreover, as the complexity of microservice applications and their access control policies increases, manual policy creation and management become challenging. On the other hand, large language models (LLMs) have shown a remarkable ability to generate complex code from natural-language specifications (user intents). This paper presents an approach to automate access-control policy generation for microservice architectures by systematically injecting architectural knowledge into LLM-based PaC generation. For a given microservice architecture, its services, operations, and their inter-dependencies are modeled using a knowledge graph. A user provides natural-language policy requests (intents), and the LLM-based PaC generation and repair pipeline retrieves and embeds the necessary information from the knowledge graph to generate the required access-control policies at the operation, service, and application levels. We evaluated our approach using six microservice benchmarks and four LLMs, with the Open Policy Agent serving as the PaC framework. The results show that hybrid approaches leveraging structured prompting and knowledge graph-based context injection significantly improve the syntactic correctness and semantic alignment of generated PaC scripts.
Language: English
Topic: Access Control and Trust
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7204840700