AGentVLM: Access control policy generation and verification framework with language models

• We introduce AGentVLM, a novel access control policy generation and verification framework. • We introduce a novel access control-specific structured information extraction method for translating complex natural language access requirements into access control policies. • We introduce a novel access control policy verification technique. • We evaluate AGentVLM, showing it achieves state-of-the-art accuracy. • We release two annotated datasets, addressing the data scarcity. Manual generation of access control policies from high-level organizational requirements is labor-intensive and error-prone, often leading to critical failures and data breaches. While automated frameworks have been proposed, existing approaches struggle with complex access requirements due to poor domain adaptation, limiting their accuracy. To address these challenges, we propose AGentVLM, a novel access control policy generation and verification framework based on small, open-source language models (LMs). Our framework enables its efficient on-premise deployment, preserving data confidentiality by avoiding reliance on third-party black-box LMs. AGentVLM excels in identifying natural language access control policies (NLACPs) from high-level requirements, achieving an average F1 score of 90.6 %. Unlike existing frameworks limited to generating simple policies with three components (subject, action, resource), AGentVLM effectively extracts complex elements such as purposes and conditions using an access control-specific structured information extraction technique. This method captures both word-level and semantic information at the same time from NLACPs, leading to a state-of-the-art policy generation F1 score of 80.6 %. Additionally, AGentVLM introduces a verification technique that provides actionable feedback, allowing administrators to refine inaccurate policies before deployment. To support future research, we also release two annotated datasets addressing the scarcity of domain-specific data.