Policy Companion: Your personal guide to authorization

Learn how our Generative AI-driven tool can be used to give your enterprise an edge in modernizing your authorization workflow.

Axiomatics   ·   Wednesday, September 18th, 2024   ·   Reading Time: 4 minutes

In my experience, I have been a part of both the mobile and SaaS revolutions in the software space and as much hype as there was, mobile felt like it took five years to really disrupt and SaaS felt like it took maybe a decade.

But Generative AI feels different.

Why now?

In September 2023, I attended Google Next in Stockholm and I was in awe of how many highly regulated companies had already started to adopt Generative AI in pretty meaningful ways. While Cloud and Mobile took over five years to disrupt and become mainstream, it had felt that Generative AI was moving a lot faster.

But AI had existed for decades at this point. So, why the sudden influx of attention? This led us to think about the gaps in the cyber security landscape, especially the authorization realm, and how Axiomatics could use Generative AI to fill those gaps.

In many respects, one of the biggest things holding the adoption of a modern authorization strategy back in enterprises is being able to translate between human-readable and machine-readable code. Authorization standards were born out of research to address the complexities that enterprises face when building access control systems. However, there are very few people in the world, let alone an enterprise, that can really absorb these standards and understand how to practically translate a human readable business requirement into machine readable code. It just so happens that translation of “human written text” into another format is at the center of Generative AI’s value.

Admittedly, being relatively new to the authorization space, I personally felt the pain of anyone trying to learn about authorization best practices and standards. I came from a data security background, which leveraged access control standards, but was very one dimensional compared to the authorization outcomes our customers are looking to achieve. I am of course very lucky to be surrounded by the foremost experts in this space – people like Babak Sadighi, David Brossard, Erik Rissanen, and Pablo Giambiagi, to educate me, but it is still intimidating.

Policy Companion: The early stages

After learning all the LLMs had already “learned” our own standard based language, Abbreviated Language for Authorization (ALFA), it dawned on me that perhaps there is an opportunity to harness this and create our own companion to help people like me learn how to write authorization requirements and policies faster. This led us to the creation of Policy Companion which we launched as a pilot in October 2023.

One of the questions that may you have is why did we only launch a pilot? Why didn’t we release “Policy Companion” in October 2023? There were three primary reasons:

• First, Generative AI technology was, and continues to move very quickly. We started using Google Vertex and moved to OpenAI before our launch after GPT-4 was released. It would have felt a bit reckless making this publicly available so quickly.
• Second, Generative privacy and security expectations were still very much unknown from the market and customers and while this is still an open question for many enterprises, at the time it was even more unclear.
• Third, we had a hypothesis that Policy Companion would provide value, but we wanted to take time to review with customers and get their initial feedback on the concept.

Ultimately, launching it as a pilot allowed us to take the time to learn all that we can about Generative AI and open Policy Companion up to the public as a free tool for everyone to experience. Now, Policy Companion is able to be your new mentor to help guide you into the world of authorization. For the advanced authorization user, Policy Companion in its current form may be too simple for their depth of knowledge; however, for the much larger percentage of people who are in many cases intimidated by authorization, Policy Companion can be a great first step for you into this wonderful world.

Things you might be wondering about Policy Companion

Can I use Policy Companion for my enterprise policies?

It depends on your organization’s current Generative AI policy, which has likely emerged over the last year. In some cases, we have seen a clear “no use of 3rd party Generative AI tools” and in other instances there are guardrails provided. We of course hope that you take Policy Companion for a test drive with generic authorization policies / requirements that you (or even ChatGPT) can come up with.

What options do you provide for a private instance/LLM?

Building on the first question, while strategies are still being defined, there seems to be a shift towards private LLMs being stood up with their data/prompts, being isolated, and not visible to a 3rd party LLM. At the moment, Policy Companion is using OpenAI. Our data retention is beholden to their terms and conditions which has a default retention for 30 days. In the future, we plan on meeting enterprises at their Generative AI strategy and ensuring they can use Policy Companion with their own private tenants.

How accurate is Policy Companion?

We are very focused on trying to ensure the most accurate outcomes of the responses; that’s the value of our Policy Companion. The challenge is that training is a never ending learning experience (no pun intended). While we feel great about the output and structure, the approach to writing an authorization policy is always complex. If you ask three different authorization experts how to write a policy, you will get four different responses. As a result, we encourage you to look at the output as a starting point to get going as opposed to the final result.

Policy Companion is a good first step, but have you considered other Generative AI use cases?

Absolutely – we see multiple options for Generative AI to help make the authorization process better across policy creation as well as more downstream when it comes to auditing and access reviews.

Take it for a spin

Try out Policy Companion for yourself. Whether you’re new to the authorization space or curious about our new Generative AI friend, we encourage everyone to take it for a test drive.

The pace at which Generative AI is moving through the technology adoption curve suggests that currently we are in “the chasm”, but soon we will be into the early majority and when that happens we want to be the windshield, not the bug.

We’re excited to take on this new journey with you and hear your thoughts on how we can learn and improve ourselves.