Can LLMs make (personalized) access control decisions?

An arXiv study shows that LLMs can make access control decisions on users' behalf according to their security preferences, with agreement with users' majority decisions reaching up to 86% in smartphone app permission scenarios. The study collected 307 user privacy preference statements and 14682 corresponding permission decisions through online data collection, compared general models with personalized models that incorporate user preferences, and collected user feedback on 1298 decisions of the personalized models. The results show that LLMs can generally reflect user preferences well and can guide users toward safer behavior; however, personalization involves trade-offs: although fitting users' individual preferences improves agreement with personal decisions, because users tend to over-grant permissions, strictly following these preferences may lead to less safe outcomes.