Conditional access control policy finding generation

Abstract

Techniques for more precise access control policy findings, use a conditional injection of policy constraints into a findings analysis. The injection of a policy constraint of a policy being analyzed into the findings analysis is conditioned on the policy itself. In particular, the injection is conditioned on whether the policy constraint is trusted in the context of the policy (e.g., unlikely to be spoofed or manipulated in the policy context). As a result, where a policy constraint can be trusted in the context of a given policy, a more precise (e.g., more specific) findings analysis of the policy based on the policy constraint can be conducted than if the policy constraint were not included in the policy finding analysis (e.g., because the policy constraint is not trusted in other policy contexts).