Extracting Database Access-Control Policies from Web Applications
Talkat 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI '26) · 2026-07-13..07-15·
summary
Ote concretely extracts implicit DB access-control policies from Ruby on Rails apps by running concolic execution to produce traces of SQL and the conditions that trigger them, then merging those into extracted SQL views; it uses an LLM coding agent to prune irrelevant branches so exploration finishes in hours (about five per app). Applied to Diaspora, Autolab, and The Odin Project, Ote finds missing legitimate permissions, overprivileged roles, and a subtle typo that turned access checks into no-ops.
AI-written summary · about
chapters (10)
- 0:00Database access-control policies
- 2:53Implicit policy problems
- 4:18Manual policy writing impractical
- 5:45Otter extracts policies from code
- 7:35Policy extraction workflow
- 9:00Concolic execution for policies
- 12:34Pruning branches with LLM agents
- 14:22Otter results on real apps
- 16:48Bugs in handwritten policies
- 17:09Summary
related talks
41mAccess Denied: the missing guide to authorization in Rails
22mOSCAL in Action: Real World Examples of Automating Policy & Comp...
25mPolicy as Code Meets OpenTelemetry: The Next Frontier of Observability
32mImplementing Authorization
52mThe Dark Underbelly of 3rd-Party Application Access to Corporate Data
19mDynamic Authorization and Policy Control for Your Kubernetes Cluster
32mOPA: So What Does the Policy Do?
25mMake Your Security Policy Auditable