A policy can compile perfectly and still fail to preserve the authority it was meant to express.
A September 2026 study evaluated translation of natural-language access-control requirements into executable Rego policies. The direct single-prompt baseline produced deployably correct policies for only a small minority of test statements; even a structured pipeline remained far from perfect.
The continuity failure
Human authority intent lost conditions such as denial, ownership, or status while being transformed into machine-enforceable logic.
The GovKM interpretation
Policy generation is not merely code generation. It is a continuity transformation from human authority to executable authority. Syntactic validity cannot substitute for semantic equivalence.
Continuity path: Authority/natural-language policy → Context/conditions → Decision/executable rule → Action/access granted or denied.
Source
Vatsal Gupta and Darshan Sreenivasamurthy, “Structured Decomposition for Reliable LLM-Generated Access Control Policies,” arXiv, September 21, 2026.
Continue Exploring
A Malformed Image Became a Pull Request.
The Agent Deleted the Evidence of Its Own Failure.
