PaperlayerView exact revision on arXiv

Source-linked AI summary

Auditing the Hand-Written Inputs of Learned Access Control

Arsalan Jalil Sarghaleh, Mehdi Hazrati

arXiv:2610.31388v1cs.CRcs.AI

TL;DR

Learned access control relies on hand-built hard-deny sets and routing maps that shield verification and learner measurement do not validate. The paper audits these artefacts and finds unsound deny clauses and degenerate rule construction, while routing conclusions vary by loss and setting.

  • Problem

    Learned access control depends on a hard-deny set and a region map that are neither verified nor checked by other components of the stack.

    Source: §1 · p. 2

  • Method

    The paper formalises hard-deny soundness, exhaustively audits prose-derived clauses, and analyzes rule-set construction and hybrid routing on public policies.

    Source: §4.3 · p. 9, §9 · p. 27

  • Results

    On two ABAC Lab policies, restriction clauses are unsound at rates of 0.50 to 0.70, and cap-and-rank is one-class in 24/24 cells for the two commonest ranking keys.

    Source: §9 · p. 27

  • Takeaways & Limitations

    The shield is exactly as good as the hard-deny set it enforces, and no better.

    Source: §9 · p. 27

    On E-Document under class-aware selection, false-permit reductions occur under only one tested learner configuration, and the relative price of the two errors remains a deployment input.

    Source: §6.4 · p. 21

Abstract

from arXiv · show

Learned access control is typically deployed behind two hand-built artefacts: a hard-deny set enforced by a small trusted shield, and a region map that decides which requests mined rules answer and which the learner answers. Verifying the shield or measuring the learner validates neither. We audit both on the five public ABAC Lab policies. First, we formalise hard-deny soundness and check it exhaustively over relations of up to 794,250 tuples. Clauses that faithfully transcribe an explicit restriction are unsound at rates of 0.50-0.70 across four elicitors - an author and three blind language-model elicitors - because prose scopes restrictions to a section while the grant relation is a disjunction over all rules: 97% of counterexamples are granted by other rules. Shipped unchecked, these deny sets would withhold 16-78% of everything the policies grant; certified, they withhold nothing. Vacuity, a second silent failure, also occurs. Second, hybrid routing needs a two-class, abstaining rule set that ABAC miners do not emit, and ranking a mixed-effect candidate pool under a cap is one-class in all 24 cells for the two commonest ranking keys. Third, for additive losses the hybrid-versus-learner effect factorises into covered mass times a rule-learner risk contrast that must be reported on both false-non-grant and false-permit loss: on two real policies, most selection rules give opposite verdicts on the two losses, and the one favourable on both holds for one policy, one learner configuration and a band of noise levels. A released artefact regenerates and checks every reported number.

1 Introduction

Learned access-control systems rely on a hard-deny set and a rule-versus-learner region map that neither shield verification nor learner measurement validates. The paper audits both artefacts and finds failures in deny-set soundness, rule-set construction, and routing comparisons.

Contributions

  • 16/23 author-written explicit-restriction clauses and 0.50–0.66 of blind language-model clauses are unsound, with 97% of counterexamples granted by other rules.Unchecked candidate sets would withhold 16–78% of policy grants; 12 independent clauses are vacuous and pass soundness without constraining any request.Source: Contributions · pp. 2–3
  • Hybrid routing requires two-class abstaining rules that miners do not emit; cap-and-rank construction produces one-class rules in every tested cell.The contribution also examines confidence thresholds under noise processes that violate the threshold result’s assumptions.Source: Contributions · p. 3
  • For additive losses, the hybrid-versus-learner effect factorises into covered mass and a rule–learner risk contrast, and routing verdicts can differ across losses.On E-Document, only class-aware selection favours rules on both losses, and that verdict holds for one policy, one learner configuration, and a band of noise levels; Workforce does not replicate it.Source: Contributions · p. 3
  • An open analysis package regenerates every reported number from public policy files and checks each manuscript value against the regenerated results.It also includes the multi-elicitor harness, frozen elicitations, and exact prompts.Source: Contributions · p. 3

Scope and organisation

  • The audits use public policy artefacts rather than operational logs; the routing result is measured on two real policies.The synthetic policy demonstrates a measurement protocol and supports no robustness claim.Source: Scope and organisation · p. 3

2 Background and Related Work

Prior work mines approximate policies and verifies policy properties, but the paper distinguishes those tasks from auditing prose-derived hard-deny clauses and constructing rule sets for hybrid routing. It situates these audits alongside work on deny rules, zero trust, residual over-granting, selective prediction, and public benchmarks.

2.1 Policy mining produces approximations

  • ABAC miners generally emit total policies, while hybrid routing needs two-class abstaining rules; their usual coverage-driven selection is not mixed-effect ranking under a cap.The paper frames cap-and-rank as a construction to examine, not as a property of published miners.Source: §2.1 · p. 4

2.2 Policy analysis, and what it is pointed at

  • Policy-analysis tools already check finite-policy properties, but this paper points the check at prose-derived hard-deny clauses and measures their soundness and vacuity.The authors claim no algorithmic novelty for the check itself.Source: §2.2 · pp. 4–5

2.3 Deny rules, prose translation, and zero trust

  • Prior work studies deny-rule expressiveness and automated policy extraction, but the cited extraction work does not exhaustively certify generated deny sets against the grant relation.The paper also places zero-trust trust scores outside the trusted computing base and states its composition result by regime.Source: §2.3 · p. 5

2.4 Residual over-granting, selective prediction, benchmarks

  • Residual-surface monitoring, selective prediction, conformal guarantees, and label-noise learning provide related tools; public ABAC Lab policies let this paper study C1 and C2 without deployment logs.The real-world policies and logs are rarely public, and the synthetic break-glass benchmark supports measurement-protocol demonstration, not robustness claims.Source: §2.4 · p. 5

3 System Model and Threat Model

The model distinguishes requests, policy grants, mined-rule regions, learner outputs, and hard-deny membership. Its guarantees depend on explicit trust assumptions: the shield’s behavior is bounded by the set it enforces, while residual-surface behavior is unchanged by the shield under clean-input preservation.

3.1 Requests, actions, policies

  • Requests have subject, object, operation, and environment attributes; mined rules classify them as covered, gap, or conflict, while the learner acts on requests routed to it.On the public binary policies, the action space reduces to deny and permit, and the latent policy supplies the sole labels.Source: §3.1 · p. 6

3.2 Assumptions and trust boundaries

  • The deterministic safety TCB includes the shield, hard-deny clauses, attested attribute store, and actuator path; the shield guarantees rely on correct code executing on every request.Pointwise clean-input preservation is stronger than the stated ε−H condition, and the hard-deny clause set is not validated by verifying the shield or authorization language.Source: §3.2 · p. 6, Table 1 · p. 7

3.3 What the trusted layer does and does not bound

  • Under clean-input preservation and correct shield execution, the shield grants nothing on H and is the identity on Sres; without clean-input preservation, grants on H are bounded by ε−H.The same enumeration used for exhaustive soundness checking can also check non-vacuity; hard-deny false positives force denials and belong in availability reporting.Source: §3.3 · p. 7, Figure 2 · p. 8

4 C1: Deny-Set Soundness

The audit asks whether prose-derived hard-deny clauses are sound against the policy’s full grant relation, rather than merely faithful to a local restriction. Exhaustive checks find frequent unsoundness, driven by the gap between section-scoped prose and a global disjunction of granting rules, and show that vacuity and scoping choices also matter.

4.1 The mechanism

  • A prose restriction may apply only within its subsection, but the grant relation unions rules across sections, so a faithfully transcribed clause can deny granted requests.This produces false denials by the trusted layer, which ordinary learner measurements do not reveal.Source: §4.1 · p. 8

4.2 The check; 4.3 Audit protocol

  • The audit freezes prose-only candidates, certifies them exhaustively, rejects failures, and permits one scoped repair; non-enumerable spaces require a complete satisfiability query.Sampling can miss a clause with 400 counterexamples in 600,000 tuples with probability about 0.51 using 1,000 requests.Source: §4.2 · p. 8, §4.3 · p. 9

4.4 Provenance: why a pooled rejection rate means nothing

  • Provenance stratification separates explicit restrictions from three elicitation-error strata, making pooled rejection rates uninterpretable; Xu–Stoller policies have no mechanism-stratum clauses.The mechanism stratum is determined reproducibly from the source sentence, while repairs are excluded from the candidate denominator.Source: §4.4 · pp. 9–10

4.5 Results; 4.6 Independent, blind elicitation

  • 16 of 23 faithful explicit-restriction clauses covered granted requests (0.70); blind elicitors also failed at 0.50, 0.58, and 0.66 versus the author’s 0.70.Across relations of up to 794,250 tuples, counterexample counts ranged from 20 to 7,665; the three independent elicitors had 63 unsound clauses among 109 pooled.Source: §4.5 · p. 10, Table 4 · p. 11, §4.6 · p. 11

4.7 Where the counterexamples come from

  • 97% of 137,454 counterexamples came from rules other than the clause’s own, and 86% came only from other subsections; tenant scoping repaired just 11 of 79 unsound clauses.The issue commonly crosses subsection boundaries that the object model cannot represent as a tenant guard.Source: §4.7 · pp. 11–12

4.8 A second failure mode: vacuity

  • Twelve of 113 independent clauses were vacuous: they covered no request yet passed soundness, so certification also needs a non-vacuity check.The clauses selected populations absent from the object model; soundness and coverage are both available from the same enumeration pass.Source: §4.8 · p. 12

4.9 How much of a verdict is the scoping choice?

  • 14 of 21 one-guard broadenings of sound restriction clauses were unsound, showing that many verdicts turn on a single scoping guard.Across all strata, 40 of 59 broadenings were unsound.Source: §4.9 · pp. 12–13

4.10 The cost of skipping the check; 4.11 What C1 establishes

  • Unchecked candidate sets would deny 16–78% of granted requests, while certified subsets deny none; reports should pair soundness with coverage and audit protocol details.The certified subsets still identify non-granted requests, including 15–50% of Workforce’s non-grants for the reported elicitors.Source: §4.10 · p. 13, §4.11 · p. 13

5 C2: Constructing a Region Map

This section argues that hybrid routing needs an abstaining, two-class rule set that ordinary ABAC miners do not emit, and examines how mining thresholds, ranking, and reporting choices affect region maps.

5.1 A hybrid region map is not a mined ABAC policy

  • The reference miner produced good policies on three of four policies (permit-F1 0.87–0.93) but no region map; its abstaining interpretation covered under 5% of requests and only permits.Cap-and-rank instead produced an all-deny region, while default-deny yielded no routing decision.Source: Table 5 · p. 14, §5.1 · p. 14

5.2 The noise ceiling: minconf must be below 1 −ε

  • Under symmetric IID label flips, a perfectly correct candidate rule has expected confidence 1−ε, so thresholds above that ceiling probabilistically exclude it.The proposition’s confidence ceiling follows from the binomial number of unflipped labels among records matching the rule.Source: §5.2 · p. 14
  • At ε = 0.15 and θ = 0.90, the exact binomial tail is 0.191 at support 36 but 2.0 × 10−6 at support 1,000, favoring low-support survivors.Above the ceiling, correct rules that survive do so by chance; the escape probability vanishes as support grows.Source: §5.2 · p. 15

5.4 Ranking, not the cap size, is the barrier

  • 24/24 cells degenerated under support- and confidence-ranked selection across the tested policies and cap sizes.Class-aware selection was non-degenerate in 0/12 cells, retaining an average of 91 minority-class rules per cell at informative mass 0.16.Source: Table 7 · p. 16, §5.4 · pp. 16–17

5.3 Where the ceiling does not transfer

  • The exact ceiling and low-support-bias prediction do not transfer unchanged to structured noise, particularly noise correlated within users or sessions.With coarse block-correlated noise, mean confidence reached 0.9067 and 72.7% of correct rules cleared minconf = 0.90; the class-dependent test was weak for E-Document’s deny-heavy reference set.Source: §5.3 · pp. 15–16

5.4 Ranking, not the cap size, is the barrier

  • Minority-class candidates had lower median support on all four policies, allowing support-ranked caps to fill every slot with majority-class rules before reaching them.The support gap ranged from 3.3× on University to 72.7× on Workforce; changing the cap size does not fix this ordering effect.Source: §5.4 · p. 16

5.5 Consequences for reporting

  • Report q and m with the operator tuple that produced them, decompose q by class, flag one-class rule sets, and never compare bare q across datasets.At skewed base rates, one-class predictions in either direction can yield the same macro-F1, making that score uninformative across datasets.Source: §5.5 · p. 17

6 C3: The Routing Decision

The routing effect for additive losses is the covered mass times the rule–learner risk contrast, which must be evaluated separately for false non-grants and false permits. Measurements show that routing verdicts depend on the loss, policy, noise level, and learner configuration.

6.1 An exact decomposition

  • For additive losses, the hybrid-versus-learner effect equals covered mass times the rule–learner risk contrast on the covered region.The relevant mass and contrast differ by loss because false non-grants and false permits condition on different subpopulations.Source: §6.1 · pp. 17–18, §6.2 · p. 18
  • The decomposition applies to additive losses, not macro-F1, and conditional-rate reports must use mass conditioned on the corresponding class.On E-Document, using overall informative mass 0.845 instead of mG = 0.257 would misattribute the false-non-grant effect by more than a factor of four.Source: §6.1 · p. 18, §6.2 · p. 19

6.2 The contrast is not one number

  • A routing verdict requires both loss-specific contrasts: one-class rule sets can look favourable on the loss their single class cannot incur.Mass mechanically scales the effect but cannot change its sign when the covered-region risks are fixed; changing coverage may also alter learner risk.Source: §6.2 · pp. 18–19

6.3 Measurement on a real policy: E-Document

  • On E-Document, class-aware selection alone favours rules on both losses, with contrasts −0.033 [−0.049, −0.020] and −0.115 [−0.127, −0.104].Both intervals exclude zero; four of five selection rules give opposite verdicts across the losses.Source: §6.3 · p. 19, Table 8 · p. 19, Figure 3 · p. 20

6.4 Robustness of the verdict

  • On E-Document, class-aware selection favours rules on both losses only for noise levels 0.02–0.15, and only one of four learner configurations yields that two-loss verdict.At ε = 0, the losses disagree; threshold tuning also makes the false-permit contrast positive.Source: §6.4 · pp. 20–21, Table 9 · p. 21

6.5 Replication on a second policy: Workforce

  • On Workforce, all five selection rules give opposite verdicts on false non-grants and false permits, so none favours rules on both losses.The routing choice remains undetermined without a price for the two errors.Source: §6.5 · p. 22, Table 11 · p. 22

7 The Composed System

This section measures the audited artefacts in a composed system, first on two real policies and then on an authored synthetic policy. It distinguishes what the shield and conformal gate guarantee from measured outcomes and stipulated deployment costs.

7 The Composed System

  • The section labels reported zeros as either construction-guaranteed or empirical, and uses the real-policy measurements before the authored synthetic demonstration.The synthetic policy exercises a five-action space, break-glass branch, and residual surface.Source: §7 · p. 22, §7.2 · p. 23

7.1 On real policies

  • On real policies, certified shields remove all learner grants on sound hard-deny sets without changing false-non-grant rates, while unchecked sets withhold 54% and 58% of policy grants.On E-Document, unchecked shielding lowers false permits from 0.30 to 0.08; on Workforce, it yields little reduction.Source: §7.1 · p. 22, Table 12 · p. 23

7.2 An authored policy with the full mechanism

  • The synthetic benchmark uses a 15-rule latent policy, noisy training labels, disjoint calibration and test samples, and six spoofable attributes withheld from learners.It is a policy-derived benchmark, not an access log or clinical-deployment claim.Source: §7.2 · p. 23

7.3 Report denial and abstention separately

  • On the authored synthetic policy, the preferred arm changes with the stipulated escalation price, and no single cost figure is reported without escalation-latency data.The experiment demonstrates the protocol, not a claim about real policies.Source: §7.3 · pp. 23–24, §7.2 · p. 23

7.4 The two mechanisms bound disjoint quantities

  • Under exchangeability, the label-conditional gate controls marginal false permits, but it does not guarantee zero grants on the hard-deny set; the shield and gate bound disjoint regions.The shield leaves the residual surface unchanged, while the gate can reduce residual grants; their guarantees compose when the hard-deny set is sound.Source: §7.4 · p. 24

7.5 Assumption failure

  • Under the stated assumptions, the shield grants on no request in the hard-deny set even when the learner is compromised, leaving the residual surface as the place an attack can affect.This is entailed by the shield construction, not an empirical observation.Source: §7.5 · p. 25

8 Threats to Validity

The paper bounds its conclusions by the elicitors, policies, configurations, and assumptions examined. Its security analysis is policy-level, not an end-to-end deployment evaluation.

8 Threats to Validity

  • The four deny-set elicitors do not establish unsound-clause rates for human policy authors, and three model elicitors from one provider may share failure modes.Counterexamples and their attribution to other rules remain verified policy facts.Source: §8 · p. 26
  • The five audited policies are not a sample, so prevalence and relationships to policy scale or tenant structure cannot be inferred.The mechanism stratum appears on case-study-derived policies and not on hand-authored instances in this set.Source: §8 · p. 26
  • The cap-and-rank degeneracy result is a search over selected settings, not a finding about published miners or an exhaustive construction search.It covers five selection rules, three cap sizes, one conjunction cap, and one miner.Source: §8 · p. 26
  • Routing recommendations vary with learner configuration and noise, and the two-loss verdict does not replicate on Workforce.The exact decomposition and divergence between losses are the conclusions that survive those variations.Source: §8 · p. 26
  • Without deployment logs, Section 7 measurements are not estimates for deployed systems; the real-world-derived policies use generated object models and injected label noise.C1–C3 and the qualitative contrast between certified and unchecked deny sets do not depend on logs.Source: §8 · p. 26

8.1 What this paper does not establish about system security

  • The analysis assumes complete mediation, communication integrity, race freedom, replay freshness, atomic updates, denial-of-service availability, and attestation integrity.These properties are not enforced, measured, or defended; failures fall outside the stated guarantees.Source: §8.1 · p. 27

9 Conclusion

The conclusion argues that two hand-built artefacts—the hard-deny set and region map—can invalidate a learned access-control system even when its shield and learner are individually verified or measured. It reports audits of those artefacts, a routing decomposition, and limits on what the evidence establishes.

9 Conclusion

  • For additive losses, the hybrid effect is covered mass times the covered-region rule–learner risk contrast, conditioned on the loss’s subpopulation.The conclusion calls for reporting both false-non-grant and false-permit outcomes.Source: §9 · p. 27
  • On two ABAC Lab policies, restriction clauses are unsound at rates of 0.50–0.70, and unchecked candidate sets would withhold 16–78% of policy grants.The conclusion also reports that 97% of counterexamples are granted by other rules and that cap-and-rank is one-class in 24/24 cells for two common ranking keys.Source: §9 · p. 27
  • The routing verdict is configuration- and policy-dependent: on E-Document, one of four learner configurations and a band of noise levels favour rules on both losses, while none does on Workforce.A certified hard-deny set removes every grant the learner makes on that set at no availability cost on E-Document.Source: §9 · p. 27
  • The paper recommends reporting practices for learned access-control evaluations behind a trusted layer, collected in a checklist.The authors state that these practices can be computed from artefacts studies already hold and require no deployment data.Source: §9 · p. 27, Table 15 · p. 28
  • Whether human policy authors share the elicitors’ unsound-clause rates, and whether the observed mechanism tracks policy scale or tenant structure, remain unknown.The authors point to a practising-policy-author study as a natural next step and state that five policies cannot resolve prevalence.Source: §9 · pp. 27–28

Data and Code Availability

The analysis uses five public ABAC Lab policies and releases code and inputs for reproducing its reported results.

Data and Code Availability

  • The study uses all five public ABAC Lab policies, none of which the authors created.The analysis code and materials are supplied to reviewers and will be archived with a persistent identifier on acceptance.Source: Data and Code Availability · p. 28
  • The released code includes a policy parser, exhaustive certifier, elicitation harness, rule miner, noise processes, shield, conformal gate, and evaluation pipelines.The artefact also includes elicitor prompts, raw outputs, and frozen candidate files with fingerprints and timestamps.Source: Data and Code Availability · p. 28
  • A deterministic script regenerates every quoted CSV value and checks it against the manuscript; the parser validates published policy statistics at run time.Experiments run on a commodity laptop using Python 3, NumPy, SciPy, and scikit-learn.Source: Data and Code Availability · p. 28

A The author elicitor’s candidate clauses

The author elicitor’s table lists candidate hard-deny clauses by provenance, exhaustive verdict, coverage, and counterexample count; it includes unsound clauses across multiple policies.

A The author elicitor’s candidate clauses

  • 6,489 counterexamples occur among 61,932 covered requests for E-Document clause ED1, an explicit restriction marked unsound.Other explicit E-Document clauses are also marked unsound, including ED2 with 1,706 counterexamples among 53,350 covered requests.Source: A The author elicitor’s candidate… · p. 29
  • Healthcare clause HC1 is marked unsound with 9 counterexamples among 68 covered requests, while Healthcare clause HC8 is marked sound with none among 84.The same table records both sound and unsound clauses in the University and Project Management policies.Source: A The author elicitor’s candidate… · p. 29
  • 7,665 counterexamples occur among 19,500 covered requests for Workforce clause WF4, marked unsound.The table also marks WF6 unsound, with 2,613 counterexamples among 40,242 covered requests.Source: A The author elicitor’s candidate… · p. 30

B Verdicts per restriction sentence and elicitor

Restriction-sentence verdicts are reported across elicitors, alongside the elicitation protocol and a counterexample-attribution table organized by elicitor.

B Verdicts per restriction sentence and elicitor

  • Across the listed restriction sentences, verdicts vary by sentence and elicitor, with unsound, sound, vacuous, and unformalized entries.For example, all four elicitors mark E-Document Rule 1 unsound, while Workforce Rule 17 has vacuous entries for two models.Source: B Verdicts per restriction sentence… · pp. 30–31

C Elicitation protocol

  • Each independent elicitor received five policy files containing prose, an attribute schema, and an output format, but no formal rules.The task was to write one faithful candidate hard-deny clause per sentence stating or implying a categorical prohibition.Source: C Elicitation protocol · p. 31

D Counterexample attribution by elicitor

  • The counterexample-attribution table breaks Section 4.7 results down by elicitor, with fractions over located unsound mechanism-stratum clauses and a scoped-repair count.Its columns distinguish counterexamples granted by the source rule, other subsections, or other tenants; scoped repair counts clauses fixed by a guard naming the clause’s tenant.Source: D Counterexample attribution by elicitor · p. 32

E Composed system on real policies, with intervals

The composed-system tables report false-permit, false-non-grant, and hard-deny-grant rates for two real policies; a separate passage identifies the criterion for selecting a synthetic-policy arm.

E Composed system on real policies, with intervals

  • 0.538 false-non-grant for learner+shield(unchecked H) on E-Document falls to 0.058 for learner+shield with checked H.For hybrid+shield(unchecked H), false-non-grant is 0.522, versus 0.033 for hybrid+shield; checked-shield H-grant is 0.000 in both rows.Source: E Composed system on real policies,… · p. 32
  • 0.580 false-non-grant for learner+shield(unchecked H) on Workforce compares with 0.031 for learner+shield with checked H.Hybrid+shield(unchecked H) has false-non-grant 0.590, versus 0.046 for hybrid+shield; checked-shield H-grant is 0.000 in both rows.Source: E Composed system on real policies,… · p. 32

F Selected arm as a function of the escalation price

  • The selected synthetic-policy arm minimizes C(λ) subject to FP ≤ 0.02 across all gbdt arms.The passage identifies this selection criterion but does not state the selected arm’s identity.Source: F Selected arm as a function of the… · p. 32

G Shield conformance tests

The shield conformance checks pass across the stated cases, testing its behavior on hard-deny and residual sets as well as break-glass handling. The released artefact regenerates and checks the reported results.

G Shield conformance tests

  • T1 confirms the shield never grants on H, and T4 confirms it is the identity on Sres under both attestation settings.Source: G Shield conformance tests · p. 33
  • T2 and T3 check that the break-glass set is disjoint from H and contains no request refused by P*; both attestation cases pass for T2.These checks concern the synthetic policy’s break-glass branch, used in Section 7 only as part of the demonstration.Source: G Shield conformance tests · pp. 32–33
  • T5 checks that the shield passes every action outside H and the break-glass set.This check concerns the synthetic policy’s break-glass branch, used in Section 7 only as part of the demonstration.Source: G Shield conformance tests · pp. 32–33
  • T6 checks Proposition 1’s equality case under an always-grant learner, while its bound excludes hard-deny false positives.Source: G Shield conformance tests · p. 33
  • T7 confirms the shield still denies on H when placed after the conformal gate.Source: G Shield conformance tests · p. 33
  • T8 flags every break-glass transformation for audit.The check concerns the synthetic policy’s break-glass branch, used in Section 7 only as part of the demonstration.Source: G Shield conformance tests · pp. 32–33

H Reproducing this paper

  • The released artefact regenerates every result file and checks every table row and quoted number against those files; a full rerun reproduced every reported value on the authors’ machine.The deterministic rerun takes about 35 minutes on a 2014 laptop CPU.Source: H Reproducing this paper · p. 33

Related papers

Loading 2610.31388v1…