{"id":"https://openalex.org/W7204840700","doi":"https://doi.org/10.1109/sse72781.2026.00016","title":"Leveraging Architectural Context in LLM-based Access Control Policy Generation for Microservices","display_name":"Leveraging Architectural Context in LLM-based Access Control Policy Generation for Microservices","publication_year":2026,"publication_date":"2026-07-01","ids":{"openalex":"https://openalex.org/W7204840700","doi":"https://doi.org/10.1109/sse72781.2026.00016"},"language":"en","primary_location":{"id":"doi:10.1109/sse72781.2026.00016","doi":"https://doi.org/10.1109/sse72781.2026.00016","is_oa":true,"landing_page_url":"https://doi.org/10.1109/sse72781.2026.00016","pdf_url":null,"source":{"id":"https://openalex.org/S7407086850","display_name":"IEEE International Conference on Software Services Engineering (SSE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Software Services Engineering (SSE)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/sse72781.2026.00016","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5148798327","display_name":"Can \u00d6nal","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I193700539","display_name":"Tilburg University","ror":"https://ror.org/04b8v1s79","country_code":"NL","type":"education","lineage":["https://openalex.org/I193700539"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Can \u00d6nal","raw_affiliation_strings":["JADS and Tilburg University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"JADS and Tilburg University","institution_ids":["https://openalex.org/I193700539"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037190736","display_name":"Marco Tonnarelli","orcid":"https://orcid.org/0009-0004-7329-6663","observed_orcids":["https://orcid.org/0009-0004-7329-6663"]},"institutions":[{"id":"https://openalex.org/I109147379","display_name":"NXP (Netherlands)","ror":"https://ror.org/059be4e97","country_code":"NL","type":"company","lineage":["https://openalex.org/I109147379"]},{"id":"https://openalex.org/I83019370","display_name":"Eindhoven University of Technology","ror":"https://ror.org/02c2kyt77","country_code":"NL","type":"education","lineage":["https://openalex.org/I83019370"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Marco Tonnarelli","raw_affiliation_strings":["Eindhoven University of Technology and NXP"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Eindhoven University of Technology and NXP","institution_ids":["https://openalex.org/I109147379","https://openalex.org/I83019370"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061039582","display_name":"Indika Kumara","orcid":"https://orcid.org/0000-0003-4355-0494","observed_orcids":["https://orcid.org/0000-0003-4355-0494"]},"institutions":[{"id":"https://openalex.org/I193700539","display_name":"Tilburg University","ror":"https://ror.org/04b8v1s79","country_code":"NL","type":"education","lineage":["https://openalex.org/I193700539"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Indika Kumara","raw_affiliation_strings":["JADS and Tilburg University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"JADS and Tilburg University","institution_ids":["https://openalex.org/I193700539"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000349425","display_name":"Damian A. Tamburri","orcid":"https://orcid.org/0000-0003-1230-8961","observed_orcids":["https://orcid.org/0000-0003-1230-8961"]},"institutions":[{"id":"https://openalex.org/I16337185","display_name":"University of Sannio","ror":"https://ror.org/04vc81p87","country_code":"IT","type":"education","lineage":["https://openalex.org/I16337185"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Damian Andrew Tamburri","raw_affiliation_strings":["JADS and University of Sannio"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"JADS and University of Sannio","institution_ids":["https://openalex.org/I16337185"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5049150712","display_name":"Willem\u2010Jan van den Heuvel","orcid":"https://orcid.org/0000-0003-2929-413X","observed_orcids":["https://orcid.org/0000-0003-2929-413X"]},"institutions":[{"id":"https://openalex.org/I193700539","display_name":"Tilburg University","ror":"https://ror.org/04b8v1s79","country_code":"NL","type":"education","lineage":["https://openalex.org/I193700539"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Willem-Jan van den Heuvel","raw_affiliation_strings":["JADS and Tilburg University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"JADS and Tilburg University","institution_ids":["https://openalex.org/I193700539"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"56","last_page":"66"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9574999809265137,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9574999809265137,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.018699999898672104,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.004100000020116568,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/microservices","display_name":"microservices","score":0.7089999914169312},{"id":"https://openalex.org/keywords/policy-as-code","display_name":"policy-as-code","score":0.9049999713897705},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9959999918937683},{"id":"https://openalex.org/keywords/knowledge-graphs","display_name":"knowledge graphs","score":0.8289999961853027},{"id":"https://openalex.org/keywords/open-policy-agent","display_name":"Open Policy Agent","score":0.7540000081062317},{"id":"https://openalex.org/keywords/structured-prompting","display_name":"structured prompting","score":0.5529999732971191}],"concepts":[{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6328999996185303},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.593500018119812},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5878999829292297},{"id":"https://openalex.org/C2778505942","wikidata":"https://www.wikidata.org/wiki/Q18344624","display_name":"Microservices","level":3,"score":0.5771999955177307},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.41690000891685486},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3474999964237213},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.30149999260902405},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.29179999232292175},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.2838999927043915},{"id":"https://openalex.org/C20136886","wikidata":"https://www.wikidata.org/wiki/Q749647","display_name":"Interoperability","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.28130000829696655},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.28130000829696655},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2793999910354614},{"id":"https://openalex.org/C2779886121","wikidata":"https://www.wikidata.org/wiki/Q288682","display_name":"XACML","level":3,"score":0.2793999910354614},{"id":"https://openalex.org/C47487241","wikidata":"https://www.wikidata.org/wiki/Q5227230","display_name":"Data access","level":2,"score":0.2770000100135803}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sse72781.2026.00016","doi":"https://doi.org/10.1109/sse72781.2026.00016","is_oa":true,"landing_page_url":"https://doi.org/10.1109/sse72781.2026.00016","pdf_url":null,"source":{"id":"https://openalex.org/S7407086850","display_name":"IEEE International Conference on Software Services Engineering (SSE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Software Services Engineering (SSE)","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1109/sse72781.2026.00016","doi":"https://doi.org/10.1109/sse72781.2026.00016","is_oa":true,"landing_page_url":"https://doi.org/10.1109/sse72781.2026.00016","pdf_url":null,"source":{"id":"https://openalex.org/S7407086850","display_name":"IEEE International Conference on Software Services Engineering (SSE)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Software Services Engineering (SSE)","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W2322013807","https://openalex.org/W2804835653","https://openalex.org/W2808767927","https://openalex.org/W2969940496","https://openalex.org/W3204538566","https://openalex.org/W4291213652","https://openalex.org/W4385834032","https://openalex.org/W4387171349","https://openalex.org/W4389279107","https://openalex.org/W4391136507","https://openalex.org/W4392348090","https://openalex.org/W4399477749","https://openalex.org/W4399993248","https://openalex.org/W4402077959","https://openalex.org/W4404823305","https://openalex.org/W4405907368","https://openalex.org/W4406460193","https://openalex.org/W4407783859","https://openalex.org/W4409361107","https://openalex.org/W4411271040","https://openalex.org/W4411995820","https://openalex.org/W4413237817","https://openalex.org/W4414648726","https://openalex.org/W4416379250","https://openalex.org/W7117990002","https://openalex.org/W7129489580","https://openalex.org/W7160397698","https://openalex.org/W7171986568"],"related_works":["https://openalex.org/W3163301295","https://openalex.org/W4399993248","https://openalex.org/W57640383","https://openalex.org/W114056371","https://openalex.org/W7170809742","https://openalex.org/W147036543","https://openalex.org/W4407938108","https://openalex.org/W7117571795","https://openalex.org/W4408119864","https://openalex.org/W7203492905"],"abstract_inverted_index":{"In":[0],"a":[1,87,122,135],"microservice":[2,62,110,124,182],"architecture,":[3,125],"services":[4],"use":[5],"access":[6,66],"control":[7,67],"policies":[8,25,31,44,68,168],"to":[9,23,90,104,163],"prevent":[10],"being":[11],"abused":[12],"by":[13,112],"external":[14],"users":[15],"and":[16,35,41,50,64,73,129,145,150,154,173,184,206,216],"other":[17,79],"(compromised)":[18],"services.":[19],"An":[20],"emerging":[21],"approach":[22,103,179],"implementing":[24],"is":[26,47],"Policy-as-Code":[27],"(PaC),":[28],"in":[29,45,53],"which":[30],"are":[32,132],"defined,":[33],"enforced,":[34],"managed":[36],"via":[37],"code.":[38],"However,":[39],"writing":[40],"maintaining":[42],"the":[43,54,59,78,146,156,160,165,170,188,194,213],"PaC":[46,55,119,148,195,221],"complex,":[48],"error-prone,":[49],"requires":[51],"expertise":[52],"frameworks.":[56],"Moreover,":[57],"as":[58,193],"complexity":[60],"of":[61,219],"applications":[63],"their":[65,130],"increases,":[69],"manual":[70],"policy":[71,107,142],"creation":[72],"management":[74],"become":[75],"challenging.":[76],"On":[77],"hand,":[80],"large":[81],"language":[82],"models":[83],"(LLMs)":[84],"have":[85],"shown":[86],"remarkable":[88],"ability":[89],"generate":[91,164],"complex":[92],"code":[93],"from":[94,159],"natural-language":[95,141],"specifications":[96],"(user":[97],"intents).":[98],"This":[99],"paper":[100],"presents":[101],"an":[102],"automate":[105],"access-control":[106,167],"generation":[108,149],"for":[109],"architectures":[111],"systematically":[113],"injecting":[114],"architectural":[115],"knowledge":[116,136,161,207],"into":[117],"LLM-based":[118,147],"generation.":[120],"For":[121],"given":[123],"its":[126],"services,":[127],"operations,":[128],"inter-dependencies":[131],"modeled":[133],"using":[134,180],"graph.":[137],"A":[138],"user":[139],"provides":[140],"requests":[143],"(intents),":[144],"repair":[151],"pipeline":[152],"retrieves":[153],"embeds":[155],"necessary":[157],"information":[158],"graph":[162],"required":[166],"at":[169],"operation,":[171],"service,":[172],"application":[174],"levels.":[175],"We":[176],"evaluated":[177],"our":[178],"six":[181],"benchmarks":[183],"four":[185],"LLMs,":[186],"with":[187],"Open":[189],"Policy":[190],"Agent":[191],"serving":[192],"framework.":[196],"The":[197],"results":[198],"show":[199],"that":[200],"hybrid":[201],"approaches":[202],"leveraging":[203],"structured":[204],"prompting":[205],"graph-based":[208],"context":[209],"injection":[210],"significantly":[211],"improve":[212],"syntactic":[214],"correctness":[215],"semantic":[217],"alignment":[218],"generated":[220],"scripts.":[222]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-09-01T00:00:00"}