Access Control Policy Verification: A Survey of Rule-Set-Based Techniques

Access control decides who can see or use which resources under what conditions. An access control policy (ACP) turns these decisions into rules that systems can enforce. In practice, access control policies (ACPs) appear as rule sets that map context to Permit/Deny outcomes. The reliability of a rule set hinges on key characteristics: consistency, completeness, correctness, non-redundancy, and freshness. Weaknesses in any of these fronts can cause security gaps or compliance failures. This paper surveys how researchers verify ACPs at the ruleset level and classifies the techniques by targeted characteristics. In addition, the paper serves as a practical guide for system administrators seeking to design, assess, and sustain robust access control policies.