prose2policy

A system for converting natural language access control policies into structured Rego policy code for Open Policy Agent (OPA).

Overview

prose2policy is a modular pipeline that processes natural language access control policies through several stages to produce valid Rego policy code. The system uses large language models (LLMs) with few-shot prompting to achieve high accuracy in policy extraction and code generation.

Architecture

The system follows a modular pipeline architecture with 5 core modules:

1. Pre-processing Module: Checks if text contains access control policy statements and simplifies them
2. Generator Module: Extracts policy components (subject, action, resource, etc.) from preprocessed text
3. Schema Validator Module: Validates extracted components against a schema
4. Rego Generator Module: Generates Rego policy code from extracted components
5. Rego Validator Module: Validates generated Rego code using the Regal linter

Features

• Few-Shot Learning: All LLM-based modules use few-shot examples for improved accuracy
• Centralized Prompt Management: All prompts are stored in a single file for easy management
• LLM Provider Abstraction: A unified interface for different LLM providers (Anthropic, OpenAI)
• Configuration System: A flexible configuration system for LLM provider selection and other settings
• Batch Processing: Support for processing multiple policies at once with file upload/download
• Web Interface: A user-friendly web interface with tabs for single policy and batch processing

Installation

1. Clone the repository:

git clone https://github.com/yourusername/prose2policy.git
cd prose2policy

2. Install dependencies:

pip install -r requirements.txt

3. Set up environment variables:

export OPENAI_API_KEY=your_openai_api_key
# Or for Anthropic
export ANTHROPIC_API_KEY=your_anthropic_api_key

Usage

Running the Web Interface

python -m prose2policy.app

Then open your browser and navigate to http://localhost:5000.

Using the API

Process a Single Policy

import requests

response = requests.post('http://localhost:5000/api/process', json={
    'policy': 'Administrators can modify user accounts in the system.'
})

result = response.json()
print(result['rego_generator']['rego_policy'])

Process Multiple Policies

import requests

response = requests.post('http://localhost:5000/api/batch', json={
    'policies': [
        'Administrators can modify user accounts in the system.',
        'Employees must not access customer financial data unless required for support purposes.',
        'Customers can view their own order history.'
    ]
})

results = response.json()['results']
for result in results:
    print(result['rego_generator']['rego_policy'])

Using the Python Library

from prose2policy.modules.preprocessor import Preprocessor
from prose2policy.modules.generator import Generator
from prose2policy.modules.rego_generator import RegoGenerator
from prose2policy.utils.config_manager import ConfigManager

# Initialize configuration manager
config_manager = ConfigManager()

# Initialize modules
preprocessor = Preprocessor(config_manager)
generator = Generator(config_manager)
rego_generator = RegoGenerator(config_manager)

# Process a policy
policy_text = "Administrators can modify user accounts in the system."
processed_text = preprocessor.process(policy_text)
components = generator.extract_components(processed_text)
rego_policy = rego_generator.generate_rego(components, policy_text)

print(rego_policy)

Configuration

Configuration can be managed through the web interface or by editing the config.json file directly.

LLM Provider Configuration

{
  "llm_provider": "anthropic",
  "openai_api_key": "your_openai_api_key",
  "openai_model": "gpt-4o",
  "anthropic_api_key": "your_anthropic_api_key",
  "anthropic_model": "claude-opus-4-5-20251101"
}

Schema Configuration

Schemas are stored in the config/schemas directory. The default schema is default_schema.json.

{
  "subjects": ["user", "admin", "guest"],
  "actions": ["read", "write", "delete", "create", "update"],
  "resources": ["document", "file", "database", "record", "system"],
  "conditions": ["time", "location", "device", "network"],
  "purposes": ["business", "personal", "security", "compliance"]
}

Testing

Quick Test

Run the test script to test the entire pipeline with a simple example:

python -m prose2policy.test_pipeline

For batch processing test:

python -m prose2policy.test_pipeline --batch

Comprehensive Testing

The project includes a comprehensive test suite that covers all modules and components:

# Run all tests
python -m prose2policy.tests.run_tests

# Run tests for a specific module
python -m prose2policy.tests.run_tests preprocessor

Available test modules:

• preprocessor: Tests for the Preprocessor module
• generator: Tests for the Generator module
• schema_validator: Tests for the Schema Validator module
• rego_generator: Tests for the Rego Generator module
• rego_validator: Tests for the Rego Validator module
• llm_providers: Tests for the LLM providers
• config_manager: Tests for the Config Manager
• prompt_manager: Tests for the Prompt Manager
• app: Tests for the main application
• integration: Integration tests for the entire system

Using pytest

You can also use pytest to run the tests:

# Install pytest if you haven't already
pip install pytest

# Run all tests
pytest prose2policy/tests/

# Run a specific test file
pytest prose2policy/tests/test_preprocessor.py

For more information about testing, see the tests README.

Project Structure

prose2policy/
├── app.py                  # Main Flask application
├── modules/                # Core modules
│   ├── __init__.py
│   ├── preprocessor.py     # Pre-processing module
│   ├── generator.py        # Generator module
│   └── rego_generator.py   # Rego Generator module
├── prompts/                # Prompt management
│   └── prompts.py          # Centralized prompt management
├── templates/              # HTML templates
│   └── index.html          # Main UI template
├── utils/                  # Utility functions and classes
│   ├── config_manager.py   # Configuration management
│   ├── regal_validator.py  # Rego validation using Regal
│   ├── schema_validator.py # Schema validation
│   └── llm_providers/      # LLM provider implementations
│       ├── __init__.py
│       ├── base.py         # Base LLM provider interface
│       ├── openai.py       # OpenAI provider
│       ├── anthropic.py    # Anthropic provider
│       └── mock.py         # Mock provider for testing
├── tests/                  # Test suite
│   ├── __init__.py
│   ├── README.md           # Testing documentation
│   ├── run_tests.py        # Test runner
│   ├── test_app.py         # Tests for the main application
│   ├── test_config_manager.py # Tests for the Config Manager
│   ├── test_generator.py   # Tests for the Generator module
│   ├── test_integration.py # Integration tests
│   ├── test_llm_providers.py # Tests for the LLM providers
│   ├── test_preprocessor.py # Tests for the Preprocessor module
│   ├── test_prompt_manager.py # Tests for the Prompt Manager
│   ├── test_rego_generator.py # Tests for the Rego Generator module
│   ├── test_rego_validator.py # Tests for the Rego Validator module
│   └── test_schema_validator.py # Tests for the Schema Validator module
├── test_pipeline.py        # Simple test script
└── config/                 # Configuration files
    └── schemas/            # Schema files
        └── default_schema.json  # Default schema

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

This project builds upon the work of the agentv_nl2rego project, which provided the initial inspiration and some reusable components.