Every day, across a wide range of industries, companies must adapt employee access profiles to reflect changes in authorization requirements. A key challenge lies in translating the needs of an employee to a technical authorization concept. Due to the rise of generative AI, it makes sense to consider Large Language Models (LLMs) for processing permission requests. This is especially relevant in large-scale access control environments, where the high number of permissions and roles makes oversight difficult for human administrators. Thus, in this contribution, we conduct quantitative research and test whether LLMs are suitable for permission request processing. We find that when embedding an access control document, an LLM performs quite well when translating a permission request into the required permission but struggles with suggesting a suitable role. We show that instead of using an LLM for both permission and role suggestions, it is more efficient to apply a hybrid approach, and first apply an LLM-based permission translation and then algorithmically search for a role that contains the translated permission.
Despite the widespread use of domain models, the modeling process remains underexplored, particularly regarding the interactions among agents, products, and activities. Building on prior work that identified 16 recurrent moments of dissatisfaction (“pain points”) experienced by modelers during these interactions, this study offers a deeper analysis to clarify the significance of these pain points and support improvements in modeling practice. Through an online survey of 49 modelers, the study provides empirical evidence on the frequency of these moments, the reasons behind the frustrations they cause, and the strategies modelers use to address them. The descriptive analysis offers valuable insights into these aspects, revealing interesting patterns among modelers. These findings have implications for practice and academia, offering a foundation to enhance the modeling experience and improve the value of domain modeling efforts.
When analysing business processes through process mining, cases are typically considered in isolation. A case is seen as one process execution, whose control-flow is only influenced by case-specific features. However, this isolated view on cases does not consider inter-case effects, which likely occur when cases compete for the availability of a fixed number of shared resources. In this paper, we study the stochastic implications of (1) transition life cycles and (2) resources. That is, we extend stochastic Petri nets with the notion of a transition life cycle to capture the non-atomicity of resources executing transitions. This then allows us to describe the competition between cases for resources stochastically and analyse how scarcity of resources influences the behaviour of real-life processes. We provide an according automated discovery method, and evaluate our technique on multiple real-life event logs by showing its applicability and feasibility, and demonstrating that new types of insights can be obtained for real-life processes.
Business processes in which decisions are made by human resources suffer from noise. Noise is unwanted variability, which leads to inconsistent and unrepeatable decisions and impacts trust negatively. In this paper, we present the Decision Noise Instrument (DNI) to quantitatively estimate the noise that can be attributed to unknown factors affecting the actors who carry out the business process. For our estimation, we solely use readily available data from business information systems that support the execution of the process. In our method, we limit the influence of factors that cannot be attributed to actors. The DNI makes it possible to compare the noise levels between and within business processes. Based on that comparison, further investigation into the problem and noise reduction efforts can be prioritized. We evaluate the DNI on a claim handling process of UWV, a public service provider in the Netherlands. Our results show that we can estimate differences between the noise levels of several decisions within the selected process of UWV. By drilling down on a decision, the subgroups that have the most impact on the noise level are identified.
Data Science (DS) technologies provide crucial competitive advantages in contemporary business environments through optimized processes. However, DS-based service systems require collaborative efforts between IT and business divisions, necessitating structured frameworks to bridge organizational gaps and ensure alignment between technical requirements and business objectives. This research examines the integration of DS systems within Enterprise Architecture (EA) models to address complex implementation challenges. EA modeling provides an indispensable, structured framework for ensuring the optimal performance of DS systems, particularly in the context of digital transformation initiatives, and enables the seamless integration of data science capabilities into organizational frameworks. This work presents a thorough literature review that critically examines existing research on integrating DS projects into EA models, offering a comprehensive view of DS integration to enhance architectural frameworks. Future work will demonstrate these holistic models in practical enterprise applications and conduct case studies to refine the model and evaluate the effectiveness of conceptual modeling approaches.
Business Process Management and Operations Research are two research fields that both aim to enhance value creation in organizations. While Business Process Management has historically emphasized on providing precise models, Operations Research has focused on constructing tractable models and their solutions. This systematic literature review identifies and analyzes work that uses combined concepts from both disciplines. In particular, it analyzes how business process models have been conceptualized as mathematical models and which optimization techniques have been applied to these models. Results indicate a strong focus on resource allocation and scheduling problems. Current approaches often lack support of the stochastic nature of many problems, and do only sparsely use information from process models or from event logs, such as resource-related information or information from the data perspective.
Extending the lifetime of household appliances, such as washing machines, is often not economically viable. Because environmental costs from the product life cycle are shifted to society, new appliances remain relatively inexpensive and sustainable alternatives are discouraged. In the literature we could not find any work that discusses how value networks in the Electrical and Electronic Equipment (EEE) embed both sustainability and economic value across the product lifecycle. This study aims to develop an approach that supports the design of sustainability-oriented value networks in the EEE sector. Based on interviews and literature, e3value models are developed that address sustainability. Eco-costs are introduced as a potential means to make environmental impacts more visible and to explore how they might contribute to more responsible value creation and decision-making by network actors. Defined information requirements of value network actors indicate the data that support sustainability-related decision-making, highlighting the enabling role of Digital Product Passports. Further research should address quantitative assessments of eco-costs and their implications across different value network configurations and decision-making scenarios.
The increasing deployment of AI agents in enterprise systems presents a critical governance challenge: ensuring clear accountability chains between humans and autonomous systems while supporting their dynamic, adaptive behavior. This paper presents a toolchain that uses the ISO-standard ODP Enterprise Language to formally specify and monitor actor responsibility. Building on our previous DSL work for ODP Enterprise Language formalism expression, we develop a software toolchain that enables domain users to define actor responsibilities and accountability against normative concepts expressed using the basic normative concepts of permissions, obligations, prohibitions, and authorizations. The toolchain supports expressing delegation scenarios between humans and agents, and across multiple agents, accommodating the dynamic nature of AI-driven enterprise systems. Our solution leverages the textX DSL development framework to create a fit-for-purpose toolchain that integrates with contemporary enterprise and AI technologies, providing formal foundations for accountable agent deployment in enterprise distributed systems.
This study investigates the role of Enterprise Architecture (EA) in enhancing business-IT alignment during a large-scale re-engineering project at a European agency. Using a qualitative case study approach, the research analyzes insights from business and IT stakeholders involved in the Surveillance Systems Re-engineering (SSR) project. Focus group sessions were conducted to identify the strengths, weaknesses, and practical recommendations for EA implementation. The findings are organized across four dimensions of alignment: Communication, Governance, Partnership, and IT Scope Architecture—adapted from Luftman’s maturity model. Results show that EA contributes significantly to mutual understanding, learning acceleration, and strategic alignment but is challenged by complex methodologies, rigid modeling languages, and organizational readiness issues.
Modern organizations manage complex processes involving multiple object types, event types, and dynamic attributes, such as stock levels, patient vital signs, or machine status, which define critical object states (e.g., Understock, Patient at Risk, Machine Down). While object-centric process mining (OCPM) with OCEL 2.0 captures these attributes, it does not systematically model state transitions, limiting insights into process dynamics. We propose State-Aware Object-Centric Process Mining (SA-OCPM), an extension of OCEL 2.0 that introduces (1) object state transition events to log changes (e.g., Normal to Understock, Patient at Risk to Stable, Machine Down to Running) and (2) object state-aware events to refine events with state context (e.g., Goods Receipt (Understock), Patient Admission (Patient at Risk), Maintenance Start (Machine Down)). Implemented in a commercial platform, SA-OCPM enables precise analysis of when, why, and how processes deviate from the optimum, as demonstrated in a logistics case study revealing inefficiencies like prolonged understock. SA-OCPM’s state-based approach enhances diagnostic granularity and is applicable to domains like healthcare, manufacturing, and customer relationship management.
Efficient resource allocation is critical for reducing the mean cycle time in business processes. While traditional heuristics like Shortest Processing Time (SPT) and First-In-First-Out (FIFO) are widely used, their effectiveness depends heavily on process characteristics. This paper introduces a Deep Reinforcement Learning (DRL) approach that dynamically selects heuristics during process execution. Our method learns adaptive heuristic selection, automatically determining when each heuristic should be applied to minimize the overall cycle time based on the current process state. Furthermore, unlike existing methods that encode each resource-to-activity assignment as a separate action, our approach limits the actions to the considered heuristics, reducing the dimensionality and complexity of the learning task. We evaluated our method on six synthetic and five real-world business processes. Our proposed method outperformed the best individual heuristic in six out of eleven scenarios and matched performance in the remaining five. The results demonstrate that adaptive heuristic selection using DRL provides a scalable and effective strategy for resource allocation that adapts to varying business process characteristics.
Enterprise Architecture (EA) plays a vital role in aligning business and IT, yet its implementation often encounters challenges due to evolving needs and past architectural decisions. These challenges, termed Enterprise Architecture debt (EA debt), arise from short-term decisions or misalignments that hinder progress toward an optimal architecture. This study proposes two taxonomies: one to characterize EA debt descriptively and another to assess its impact. The taxonomies were developed using systematic literature reviews and refined with practitioner feedback. They offer a structured approach to identify, describe, and evaluate EA debts, enabling organizations to address them systematically. The study demonstrates the application of the taxonomies through a real-world case example, illustrating their potential to support strategic and operational decision-making. These contributions aim to enhance the theoretical foundation and practical management of EA debts, fostering better alignment of architectures with organizational goals.
Current clinical trial matching solutions lack practical, consumer-accessible tools that enable independent trial discovery. This paper presents a solution that makes use of HL7 FHIR standard, and several AI Agents that empower consumers to independently identify relevant clinical trials using their personal health information. The system employs four specialized agents using HL7 FHIR data: (1) extracting medical conditions from consumer records; (2) pre-filtering trials using vector embeddings; (3) structuring unstructured eligibility criteria; and (4) evaluating patient eligibility against trial requirements. The framework generates relevance scores and provides ranked trial recommendations within 5-10 min, which would typically require days of manual effort. Integrated into a web-based platform, this AI-driven approach enables consumers or patients to directly discover pertinent clinical trials without clinical staff intervention, significantly improving access to potentially life-saving research opportunities.
Resilience is recognized as a critical property of complex social-ecological-technological systems (SETS). Yet, its modeling remains fragmented, often lacking semantic rigor, reusability, and cross-domain applicability. This paper introduces LaDeRR (Language for Describing Risk and Resilience), a novel domain-specific modeling language (DSML) grounded in ResiliOnt—a well-founded core ontology for resilience. LaDeRR enables the formal specification and analysis of resilience scenarios through constructs representing capabilities, vulnerabilities, threats, and emergent resilience configurations. It supports a complete workflow, including textual syntax, RDF-based representation, semantic validation with SHACL, rule-based inference, and automated visualization. LaDeRR explicitly supports both proactive design-time analysis and retrospective modeling, allowing users to formally specify and analyze both ongoing and past resilience scenarios. This dual capability supports improved decision-making and long-term resilience planning. A representative case study in supply chain disruption demonstrates LaDeRR’s expressiveness in identifying system vulnerabilities, modeling resilience strategies, and evaluating dynamic scenario outcomes. By integrating ontological precision with robust computational support leveraging logical reasoning, LaDeRR helps bridge the gap between theoretical foundations and applied resilience engineering.
This paper analyzes the proliferation of cybersecurity ontologies, arguing that this surge cannot be explained solely by technical shortcomings related to quality, but also by a credibility deficit - a lack of trust, endorsement, and adoption by users. This conclusion is based on our first contribution, which is a state-of-the-art review and categorization of cybersecurity ontologies using the Framework for Ontologies Classification (F4OC) framework. To address this gap, we propose a revised framework for assessing credibility, introducing indicators such as institutional support, academic recognition, day-to-day practitioners’ validation, and industrial adoption. Based on these new credibility indicators, we construct a classification scheme designed to guide the selection of ontologies that are relevant to specific security needs. We then apply this framework to a concrete use case: the Franco-Luxembourgish research project ANCILE ( https://www.linkedin.com/company/autonomic-cybersecurity-with-adversarial-learning-and-explanations ), which illustrates how a credibility-aware evaluation can reshape ontology selection for operational contexts.
Ensuring the integrity of business processes without disclosing confidential business information is a major challenge in inter-organizational processes. This paper introduces a zero-knowledge proof (ZKP)-based approach for the verifiable execution of business processes while preserving confidentiality. We integrate ZK virtual machines (zkVMs) into business process management engines through a comprehensive system architecture and a prototypical implementation. Our approach supports chained verifiable computations through proof compositions. On the example of product carbon footprinting, we model sequential footprinting activities and demonstrate how organizations can prove and verify the integrity of verifiable processes without exposing sensitive information. We assess different ZKP proving variants within process models for their efficiency in proving and verifying, and discuss the practical integration of ZKPs throughout the Business Process Management (BPM) lifecycle. Our experiment-driven evaluation demonstrates the automation of process verification under given confidentiality constraints.
Modern Security Orchestration, Automation, and Response (SOAR) platforms must rapidly adapt to continuously evolving cyber attacks. Intent-Based Networking has emerged as a promising paradigm for cyber attack mitigation through high-level declarative intents, which offer greater flexibility and persistency than procedural actions. In this paper, we bridge the gap between two active research directions: Intent-Based Cyber Defense and Autonomic Cyber Defense, by proposing a unified, ontology-driven security intent definition leveraging the MITRE-D3FEND cybersecurity ontology. We also propose a general two-tiered methodology for integrating such security intents into decision-theoretic Autonomic Cyber Defense systems, enabling hierarchical and context-aware automated response capabilities. The practicality of our approach is demonstrated through a concrete use case, showcasing its integration within next-generation Security Orchestration, Automation, and Response platforms.
Process management systems support key decisions about the way work is allocated in organizations. This includes decisions on which task to perform next, when to execute the task, and who to assign the task to. Suitable software tools are required to support these decisions in a way that is optimal for the organization. This paper presents a software library, called GymPN, that supports optimal decision-making in business processes using Deep Reinforcement Learning. GymPN builds on previous work that supports task assignment in business processes, introducing two key novelties: support for partial process observability and the ability to model multiple decisions in a business process. These novel elements address fundamental limitations of previous work and thus enable the representation of more realistic process decisions. We evaluate the library on eight typical business process decision-making problem patterns, showing that GymPN allows for easy modeling of the desired problems, as well as learning optimal decision policies.
Digital societies increasingly rely on trustworthy proofs of physical presence for services such as supply-chain tracking, e-voting, ride-sharing, and location-based rewards. Yet, traditional localization methods often lack cryptographic guarantees of where and when an entity was present, leaving them vulnerable to spoofing, replay, or collusion attacks. In response, research on Proof-of-Location (PoL) has emerged, with recent approaches combining distance bounding, distributed consensus, and privacy-enhancing techniques to enable verifiable, tamper-resistant location claims. As the design space for PoL systems grows in complexity, this paper provides a unified framework to help practitioners navigate diverse application needs. We first propose a taxonomy identifying four core domains: (1) cryptographic guarantees, (2) spatio-temporal synchronization, (3) trust and witness models, and (4) interaction and overhead. Building on this, we introduce a methodology to map application-specific requirements onto appropriate PoL architectures. We illustrate this process through three use cases (retail e-coupons, supply chain auditing, and physical e-voting), each showing how different constraints shape protocol choices. Overall, this work offers a structured approach to building secure, scalable, and interoperable PoL systems.
In this work, we explore the application of Enterprise Architecture (EA) frameworks, specifically TOGAF and ArchiMate, to model the alignment between socio-political artifacts and technological artifacts within Decentralised Autonomous Organisations (DAOs). DAOs are new organisation model that leverages blockchain (BC) technology to implement decentralised governance such as Liquid Democracy (LD) which respect anarchist principles. However, the challenge lies in demonstrating the traceability between socio-political governance processes and the technological artifacts that enables these processes. This paper addresses this gap by applying Design Science Research (DSR) methodology to develop a reference architecture. This Architecture serves as a structured model to analyze and verify the alignment of decentralised governance processes with their technological implementations DAOs. This work contribution is a systematic approach to modelisation and analysis of socio-political structures of decentralised organisations, ensuring they align with the underlying technology supporting them.
