A core aspect of every information system is access control, a security mechanism that regulates operations within an organization. One of the most popular access control models is Role-Based Access Control (RBAC). However, in a dynamic environment where users regularly request new permissions, it is not trivial to quickly assign correct, yet secure, roles. As permission requests are usually formulated in natural language, we consider Large Language Models (LLMs) suitable tools for processing permission requests and thereby supporting IT security officers in identifying appropriate roles. In this article, we formally introduce Permission Request Processing (PRP), conceptualize PRP setups, and evaluate the resulting experiments. Our findings suggest first building a Retrieval-Augmented Generation (RAG) pipeline by providing an LLM with similar permissions to the current request and letting it choose the required permission, and then using an algorithm to return the smallest role that contains the found permission. Depending on the used data set, providing an LLM with the top-10 semantically most similar permissions to the current request thereby achieves role accuracy ranging from 83% to 100% while reliably adhering to the Principle of Least Privilege (PoLP), as the suggested roles almost always contain the least possible number of additional permissions. Also, taking uncertainty into account, the share of incorrect role suggestions never exceeds 8%.
This paper proposes a two-stage clustering algorithm called TscEcs (two-stage clustering using edge-cutting and statistics) based on proximity graphs. The method first represents spatial data using a Delaunay triangulation and Gabriel graph, then prunes long edges through global and local cutting strategies incorporating geometric characteristics and robust statistical features. After graph partitioning, clusters are formed from connected components, with outliers identified using an elbow method based on component size. Experimental results on synthetic and real-world datasets demonstrate that TscEcs effectively detects clusters of arbitrary shapes, varying densities, and imbalanced sizes while requiring fewer input parameters compared to traditional methods such as DBSCAN, OPTICS, and HDBSCAN, achieving competitive or superior performance across multiple external clustering criteria.
In our primary work, we presented a comparative evaluation of behavioral similarity methods for business process models, assessing Prime Event Structures (PES), Transition Adjacency Relations (TAR) and trace alignment computed with PM4Py on the Process Model Matching Contest 2015 benchmark, where PES achieved the highest effectiveness. In this companion paper, we describe how to reproduce the entire experimental study through a Docker-based pipeline, with step-by-step instructions that regenerate every reported result, including the statistical analyses. While making the experiments reproducible, we identified and removed a source of non-determinism in the trace simulation of PM4Py: repeated executions now yield identical values, and the ranking of the three methods reported in the primary work is preserved. We also assess the stability of the findings on systematically generated process model variants with controlled structural and behavioral perturbations, and we explain how the experiments can be extended to new process models, parameters and similarity methods. All materials, including source code, datasets and protocols, are publicly available, enabling exact replication and extension by other researchers.
Enterprise information systems manage business objects with persistent control states across transactions and changing organizations, posing a stateful enterprise control problem that requires consistent alignment of object identity, valid state transitions, execution authority, and audit evidence over time. This study establishes design knowledge for such scenarios, focusing on budget commitments. Using design science research, it proposes three technology-independent principles: Commitment Identity Binding, Context-Bound State Transition, and Controlled Execution Boundary and Evidence. These principles are implemented in a three-layer artifact combining a Knowledge Graph (KG), a state-transition module (SAI), and an audit evidence generation module (AIG) for context representation, state control, and structured evidence generation. Evaluated on 18 months of enterprise data, expert cases, ablation tests, historical replay, safety checks, and experiments with 30 practitioners, the artifact yields key findings: state consistency does not guarantee evidential completeness, and accurate rule identification cannot ensure valid transitions without temporal context. Historical Replay successfully replicated all 90 test cases under original contexts. When substantive information was held comparable, structured evidence improved final-state and rule-basis judgments and reduced review time. This work provides integrated design knowledge for stateful enterprise control over persistent business objects.
