@inproceedings{rammouz-etal-2026-embarrassingly,
title = "Embarrassingly Simple Access Control for Large Language Models",
author = "Rammouz, Veronica and
Klisura, {\DJ}or{\dj}e and
Krishnan, Ram and
Rios, Anthony",
editor = "Zhang, Yue and
Xu, Ruifeng and
Purwarianti, Ayu and
Rong, Tong and
Suzuki, Jun",
booktitle = "Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the {A}sia-Pacific Chapter of the {A}ssociation for {C}omputational {L}inguistics (Volume 1: Long Papers)",
month = nov,
year = "2026",
address = "Hengqin, China",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.aacl-long.110/",
pages = "2417--2431",
ISBN = "979-8-89176-439-2",
abstract = "Role-Based Access Control (RBAC) is fundamental in secure systems handling healthcare, financial, and government data. Prior work on LLM safety under role constraints has largely relied on fine-tuning or prompting-based enforcement. In contrast, we take a mechanistic view and probe internal representations to identify signals associated with roles, permissions, and refusal behavior. We evaluate this approach across three datasets, database- and department-separated splits, varying policy complexity levels, and adversarial prompts. On the structured Text-to-SQL datasets, simple probes achieve strong performance, reaching average macro-F1 scores of .913 on \textsc{BIRD} and .926 on \textsc{Spider}, while remaining more stable than prompting as policies grow longer. However, probing does not perform equally well in all settings: it underperforms prompting in most \textsc{OrgAccess} comparisons and can degrade substantially under adversarial instructions. Overall, our results show that access-control information can be strongly represented in LLM hidden states, but its usefulness depends on the model, domain, and prompt."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="rammouz-etal-2026-embarrassingly">
<titleInfo>
<title>Embarrassingly Simple Access Control for Large Language Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Veronica</namePart>
<namePart type="family">Rammouz</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Đorđe</namePart>
<namePart type="family">Klisura</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ram</namePart>
<namePart type="family">Krishnan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Anthony</namePart>
<namePart type="family">Rios</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-11</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yue</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruifeng</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ayu</namePart>
<namePart type="family">Purwarianti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tong</namePart>
<namePart type="family">Rong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Suzuki</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Hengqin, China</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-439-2</identifier>
</relatedItem>
<abstract>Role-Based Access Control (RBAC) is fundamental in secure systems handling healthcare, financial, and government data. Prior work on LLM safety under role constraints has largely relied on fine-tuning or prompting-based enforcement. In contrast, we take a mechanistic view and probe internal representations to identify signals associated with roles, permissions, and refusal behavior. We evaluate this approach across three datasets, database- and department-separated splits, varying policy complexity levels, and adversarial prompts. On the structured Text-to-SQL datasets, simple probes achieve strong performance, reaching average macro-F1 scores of .913 on BIRD and .926 on Spider, while remaining more stable than prompting as policies grow longer. However, probing does not perform equally well in all settings: it underperforms prompting in most OrgAccess comparisons and can degrade substantially under adversarial instructions. Overall, our results show that access-control information can be strongly represented in LLM hidden states, but its usefulness depends on the model, domain, and prompt.</abstract>
<identifier type="citekey">rammouz-etal-2026-embarrassingly</identifier>
<location>
<url>https://aclanthology.org/2026.aacl-long.110/</url>
</location>
<part>
<date>2026-11</date>
<extent unit="page">
<start>2417</start>
<end>2431</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Embarrassingly Simple Access Control for Large Language Models
%A Rammouz, Veronica
%A Klisura, Đorđe
%A Krishnan, Ram
%A Rios, Anthony
%Y Zhang, Yue
%Y Xu, Ruifeng
%Y Purwarianti, Ayu
%Y Rong, Tong
%Y Suzuki, Jun
%S Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)
%D 2026
%8 November
%I Association for Computational Linguistics
%C Hengqin, China
%@ 979-8-89176-439-2
%F rammouz-etal-2026-embarrassingly
%X Role-Based Access Control (RBAC) is fundamental in secure systems handling healthcare, financial, and government data. Prior work on LLM safety under role constraints has largely relied on fine-tuning or prompting-based enforcement. In contrast, we take a mechanistic view and probe internal representations to identify signals associated with roles, permissions, and refusal behavior. We evaluate this approach across three datasets, database- and department-separated splits, varying policy complexity levels, and adversarial prompts. On the structured Text-to-SQL datasets, simple probes achieve strong performance, reaching average macro-F1 scores of .913 on BIRD and .926 on Spider, while remaining more stable than prompting as policies grow longer. However, probing does not perform equally well in all settings: it underperforms prompting in most OrgAccess comparisons and can degrade substantially under adversarial instructions. Overall, our results show that access-control information can be strongly represented in LLM hidden states, but its usefulness depends on the model, domain, and prompt.
%U https://aclanthology.org/2026.aacl-long.110/
%P 2417-2431
Markdown (Informal)
[Embarrassingly Simple Access Control for Large Language Models](https://aclanthology.org/2026.aacl-long.110/) (Rammouz et al., AACL-IJCNLP 2026)
ACL
- Veronica Rammouz, Đorđe Klisura, Ram Krishnan, and Anthony Rios. 2026. Embarrassingly Simple Access Control for Large Language Models. In Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2417–2431, Hengqin, China. Association for Computational Linguistics.