Reference material
What allow, hold, and deny mean
Start with the authority to act. A probability attached to a decision cannot supply missing permission.
Start the guided walkthrough →
The decision boundary
An agent can produce a convincing plan and still lack permission to execute it. This study asks a narrower question. Given a written rule, facts, and a proposed action, which authorization decision should a model return?
The case bank uses three labels.
| Decision | Meaning under the supplied policy |
|---|---|
| Allow | Permission is established and the applicable prerequisites are satisfied. |
| Hold | A prerequisite or required authority is unresolved or unmet, with no applicable express prohibition established. |
| Deny | An express prohibition applies to the proposed action. |
The proposed action does not prove its own prerequisites. “Send the approved file” cannot establish that the file has actually been approved. The facts must do that work. An express prohibition takes precedence over permission in the study’s policy.
Hold and invalid describe different events
Hold is a meaningful answer about authority. It can be correct even when the model is certain. It is not a fitted confidence threshold or a rejection of an input because the model is unsure.
Invalid describes a failed response contract. An incomplete JSON response is invalid even if a reader thinks they can guess the intended label. The study made no repair, retry, or conversion of invalid output to hold. Primary accuracy counts that assigned case as incorrect.
The browser exercise below applies a deliberately simple three-condition rule. It teaches precedence. It does not run CLM, JEV, KEV, or GLM, parse a real organization’s policy, or reproduce a benchmark case.
Evaluation and enforcement
Attribute-based access control considers the subject, resource, operation, and context against policy. Here those conditions appear in written situations. No proposed action was executed, and no live enforcement system was tested. The study therefore does not establish that a deployed agent intercepts every action, resists adversarial interactions, or safely handles an approval workflow.
Correctness throughout this reader means agreement with the frozen reviewed reference. The 300 cases were initially drafted with Codex and reviewed by one author. The key was fixed before scored inference, but it was not independently adjudicated by a second blinded reviewer.
Read the sources
Original paper, sections I–III · NIST SP 800-162 · Selective classification paper
Browser teaching tool
Try the policy rule
Set prerequisites to Yes and watch Hold become Allow. Then set express prohibition to Yes and observe Deny.
This simplified rule uses established evidence states. It does not interpret policy text or authorize an action.