PRP Research Data

General These data form the basis for the journal article “Permission request processing: An exploration and comparative evaluation of LLM-based approaches for role identification”, DOI: https://doi.org/10.1016/j.is.2026.102825 The data is adapted from the Azure RBAC documentation, © Microsoft Corporation, licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). The source was retrieved on April 28, 2026. Future updates to the original data are not tracked or incorporated. The modified data is shared under the same CC BY 4.0 license. This dataset is provided “as is”, without warranty of any kind. No guarantee is made regarding its correctness, completeness, or fitness for a particular purpose. The modifications were made for research purposes; for authoritative information, please refer to the original Microsoft documentation. Details all_permissions/:Explicit permissions are fully specified (e.g. "microsoft.containerservice/fleets/members/healthz/log/read"); wildcard permissions contain an "*" (e.g. "microsoft.containerservice/fleets/*") all_explicit_permissions.txt: Explicit permissions found in the Azure RBAC documentation using a regular expression. Completeness is not guaranteed, as the extraction may miss permissions that deviate from the expected pattern. all_wildcard_permissions.txt: Wildcard permissions (those containing an "*") found in the documentation. wildcard_mapping.csv: Mapping of each wildcard permission to the explicit permissions it matches. wildcard_sizes.csv: Each wildcard permission with the number of explicit permissions it covers. all_roles/: roles_data.csv: An overview of all Azure RBAC roles at the time of retrieving the source data. Every row has five columns: category, the Azure RBAC category the role was found in, role_name, the name of the role, role_id, the id of the role, assignable_scopes, the assignable scopes of the role, and deny_operations, a boolean value which is True only if the role contains permissions of type notActions or notDataActions. If a role only contains permissions of type actions and dataActions, then deny_operations is False. preprocessed_pa/: Each file contains a modified permission-to-role assignment relation for an Azure RBAC category. Every row has two columns: role_name, the name of a role, and permission_name, an assigned permission. Note that each file includes only those roles which only contain permissions of type actions and dataActions (deny_operations = False in roles_data.csv). In our experiments, we did not include any roles that deny operations. requests_final/: Each of the three CSV files contains permission requests for one Azure RBAC category. Every row has two columns: request, a natural-language request written in first person (adapted from the Microsoft permission description!), and permission_name, the permission that satisfies it (ground truth). The permission can be explicit or a wildcard. output/: Each of the three subfolders describes the PRP output for one Azure RBAC category. Each category subfolder contains three more subfolders: baseline/: PRP output for baseline experiments. In the paper: (B) setup. The CSV files in this subfolder follow this naming scheme: B_<llm-id>.csv rbac-aware/: PRP output for rbac-aware experiments. In the paper: (A) setup. The CSV files in this subfolder follow this naming scheme:A_<llm-id>_<target share of assigned roles for requesting user>_<number of permissions in system prompt>_<role suggestion method>.csv no-llm/: PRP output for no-llm experiments. In the paper: (N) setup. The CSV files in this subfolder follow this naming scheme:N_ibm_granite-embedding-278m-multilingual_<target share of assigned roles for requesting user>.csv Each CSV file contains the results of a PRP experiment. Every row has three columns: request, a natural-language request, permission, the request-to-permission translation by the PRP system, and role, the role suggestion by the PRP system. PRP Experiment Workflow For a specific category cat, a PRP system traverses each request in requests_final/ for n times and creates a request-to-permission translation as well as a role suggestion. For our experiments, we stored those solutions in output/. To evaluate whether the PRP system found the correct permission, you can check the ground truth in requests_final/. It may happen that the request-to-permission translation is a wildcard permission which matches the ground truth. all_explicit_permissions.txt and all_wildcard_permissions.txt help you understand whether the request-to-permission translation is hallucinated or not. roles_data.csv helps you to understand whether the role suggestion is hallucinated or not. To check if a role suggestion is correct, you can use the csv file in preprocessed_pa/, that corresponds to the category cat, and check if the suggested role contains the ground truth permission or a wildcard permission which matches the ground truth. We refer to https://doi.org/10.1016/j.is.2026.102825 for any additional information required to understand our experiment design.