With increasing emphasis on transparency in digital governance, users expect more than silence when their access requests are denied by a system. However, authorization methods are notorious for their inability to provide any form of meaningful feedback under such situations. This paper shows a direction towards how the problem of explainability can be mitigated in the context of Attribute-based Access Control (ABAC), arguably the most researched topic in access control in recent years. We introduce EXTree, which represents ABAC policies optimized for both fast evaluation (Efficiency) and human-centric feedback (Explainability) in the form of a tree. Two strategic dimensions are investigated, namely, Feedback Evaluation Strategies - how to craft actionable explanations when access is denied, and Tree Construction Strategies - how the policy trees should be structured for efficient yet interpretable decisions. Through extensive experiments, we compare entropy-based, changeability-based, and randomly generated trees across multiple configurations. Our results demonstrate that EXTree, built for efficiency and interpretability, can bridge the gap between complex authorization logic and human understanding.

翻译：随着数字治理对透明度的日益重视，用户在系统拒绝其访问请求时不再满足于静默反馈。然而，授权方法因在此类情况下无法提供任何有意义的反馈而著称。本文展示了在属性基访问控制这一近年来访问控制领域最受关注的研究主题中，如何缓解可解释性问题的一种方向。我们引入EXTree，它以树结构形式表示围绕快速评估（效率）与以人为中心的反馈（可解释性）两方面优化的ABAC策略。本文研究了两个战略维度：反馈评估策略——如何在访问被拒绝时构建可操作的说明，以及树构建策略——如何构建策略树以实现高效且可解释的决策。通过大量实验，我们比较了基于熵、基于可变性以及随机生成的树在多种配置下的表现。结果表明，专为效率和可解释性构建的EXTree，能够弥合复杂授权逻辑与人类理解之间的鸿沟。