用大模型读懂政策，自动判断数据访问是否合规。
Policy-Aware Generative AI for Safe, Auditable Data Access Governance
- 用自然语言理解政策和元数据，六步推理+硬性规则拦截
- 14个案例中13个决策完全正确，拒绝对全召回，零误放行
- 输出可审计理由，适合需要合规与安全的系统设计者
企业需要满足最小权限、符合法规且可审计的数据访问决策。本文提出一种策略感知控制器，利用大语言模型（如 Google Gemini 2.0 Flash）解析自然语言请求，基于书面策略和元数据而非原始数据进行判断。系统采用六阶段推理框架（上下文理解、用户验证、数据分类、业务目的检验、合规映射、风险综合），设置早期硬性策略关卡，实行默认拒绝。输出结果为 APPROVE、DENY 或 CONDITIONAL，附带引用控制项和机器可读理由。在涵盖七类场景的十四种典型案例上进行隐私保护基准评估，结果显示：引入策略关卡后精确决策匹配率从10/14提升至13/14（92.9%），拒绝对召回率达1.00，必须拒绝场景的误批准率为0，功能适当性和合规遵从性均为14/14。专家对理由质量评分高，中位延迟低于一分钟。表明策略约束下的大模型推理结合显式关卡与审计轨迹，可将人类可读政策转化为安全、合规、可追溯的机器决策。
原文摘要 · Abstract (English)
Enterprises need access decisions that satisfy least privilege, comply with regulations, and remain auditable. We present a policy aware controller that uses a large language model (LLM) to interpret natural language requests against written policies and metadata, not raw data. The system, implemented with Google Gemini~2.0 Flash, executes a six-stage reasoning framework (context interpretation, user validation, data classification, business purpose test, compliance mapping, and risk synthesis) with early hard policy gates and deny by default. It returns APPROVE, DENY, CONDITIONAL together with cited controls and a machine readable rationale. We evaluate on fourteen canonical cases across seven scenario families using a privacy preserving benchmark. Results show Exact Decision Match improving from 10/14 to 13/14 (92.9\%) after applying policy gates, DENY recall rising to 1.00, False Approval Rate on must-deny families dropping to 0, and Functional Appropriateness and Compliance Adherence at 14/14. Expert ratings of rationale quality are high, and median latency is under one minute. These findings indicate that policy constrained LLM reasoning, combined with explicit gates and audit trails, can translate human readable policies into safe, compliant, and traceable machine decisions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。