Machine Learning in Access Control: A Taxonomy [Systematization of Knowledge Paper]

Developing and managing access control systems is challenging due to the dynamic nature of users, resources, and environments. Recent advancements in machine learning (ML) offer promising solutions for automating the extraction of access control attributes, policy mining, verification, and decision-making. Despite these advancements, the application of ML in access control remains fragmented, resulting in an incomplete understanding of best practices. This work aims to systematize the use of ML in access control by identifying key components where ML can address various access control challenges. We propose a novel taxonomy of ML applications within this domain, highlighting current limitations such as the scarcity of public real-world datasets, the complexities of administering ML-based systems, and the opacity of ML model decisions. Additionally, we outline potential future research directions to guide both new and experienced researchers in effectively integrating ML into access control practices.