[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-ai-that-writes-access-rules-and-then-checks-its-own-work":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},3863,"ai-that-writes-access-rules-and-then-checks-its-own-work","AI That Writes Access Rules and Then Checks Its Own Work","AutoCedar uses a verifier loop to convert natural-language requirements into Cedar policies that are formally checked before anyone ships them.","An AI system that writes access control policies and won't quit until a verifier signs off sounds like a reasonable ask — turns out it needed a research paper to get there.\n\nAutoCedar is a framework from academic researchers that tackles a specific, underappreciated failure mode: large language models can generate access control policies that look correct and compile cleanly while quietly granting permissions nobody intended. The system breaks the problem into small \"intent atoms\" — discrete, reviewable claims about vocabulary and expected behavior. Those atoms go through mechanical validation and a human review step before the model ever writes a policy. Once a candidate policy exists, a verifier checks it against the approved target; every failure comes back as a concrete repair signal telling the model whether to broaden, narrow, or restructure its output. The benchmark, CedarBench, covers 221 authorization tasks, and AutoCedar converged on all of them. Three case studies — healthcare, education, and conference management — put it through noisy, real-world prose requirements and came out with formally verified Cedar policy stores.\n\nWhy this matters: most LLM-in-the-loop security tooling stops at \"did it run without errors,\" which is a dangerously low bar for anything governing who can read what. AutoCedar's verifier-feedback loop is structurally similar to how formal methods teams have worked for decades — the novelty is using an LLM to do the drafting while keeping the verification mechanical and human-reviewable. Cedar, Amazon's open-source policy language, has been gaining traction since AWS released it in 2023, so the timing is not accidental.\n\nThe gap between \"policy compiles\" and \"policy does what you intended\" has caused real breaches before; the interesting question is whether a framework like this can survive contact with the messier requirements documents actual organizations produce.","[\"access control\",\"ai\",\"formal verification\",\"security\"]","2026-07-07T04:00:00.000Z","2026-07-07T10:19:13.157Z","2026-07-07T10:19:16.073Z","published",null,[],"ai",[26,24,27,28],"access control","formal verification","security",[30],{"name":31,"url":32},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2607.03656",0,{"sections":35},[36,40,44,49,54,59,64,69,74,78,83,87,92,97],{"name":37,"slug":24,"count":38,"latest_published_at":39},"AI",2590,"2026-07-16T04:00:00.000Z",{"name":41,"slug":28,"count":42,"latest_published_at":43},"Security",294,"2026-07-15T19:59:48.000Z",{"name":45,"slug":46,"count":47,"latest_published_at":48},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":18},"Dev Tools","dev-tools",59,{"name":79,"slug":80,"count":81,"latest_published_at":82},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":84,"slug":85,"count":81,"latest_published_at":86},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]