Towards Explainable Access Control

Access control (AC) systems play an important role in ensuring security by regulating how resources are accessed, protecting sensitive information, and maintaining system integrity. Their complexity arises not only from diverse policies and mechanisms but also from the involvement of multiple stakeholders, including resource owners, administrators, and end-users. Taking inspiration from explainable AI and explainable security, we define the first model of access control explainability, as a quality measure of the explanation graph constructed around the decisions made within the AC system. We then explore the literature to identify how existing work can be integrated as explanatory processes. Finally, we leverage our framework to articulate three open research challenges: the collection and interpretation of AC decisions, the effective construction of AC explanation graphs, and the definition of meaningful and computationally efficient explanation quality metrics.