Imagine you hire a fancy AI sommelier for your restaurant, but you also keep a laminated cheat sheet taped to the bar: 'NEVER serve red wine with fish.' Sounds safe. Except nobody checked whether the cheat sheet contradicts the rest of the menu — and it turns out the cheat sheet bans half the pairings the restaurant actually serves. That's the state of learned access control: the ML model gets all the scrutiny, while the hand-written safety layer silently breaks things. The committed claim: the two hand-built artefacts that bracket every learned ABAC deployment — hard-deny sets and hybrid routing maps — are both unsound in ways that nobody has formally audited until now. This is not about the learner being wrong. It's about the trusted human inputs being wrong, at scale, across all five public ABAC Lab benchmark policies. The hard-deny results are the headline. Clauses written to faithfully transcribe explicit policy restrictions are unsound at rates of 0.50–0.70 across four independent elicitors (one human author, three LLM elicitors). The mechanism is precise and damning: prose-language restrictions scope a denial to one section of a policy, but the grant relation is a disjunction over all rules. So 97% of the counterexamples — requests the deny set blocks but the policy actually grants — are granted by other rules the deny-clause author didn't consider. Shipped unchecked, these deny sets would withhold 16–78% of everything the policies legitimately grant. After exhaustive certification against up to 794,250 tuples, they withhold nothing. The gap between 'sounds right' and 'is right' is enormous. The hybrid routing audit is structurally different and arguably more interesting for the field. Hybrid systems need a two-class, abstaining rule set to decide which requests go to mined rules versus the learner. ABAC miners don't produce this — they produce ranked candidate pools. The authors show that ranking a mixed-effect pool under a selection cap collapses to a one-class problem in all 24 examined cells for the two most common ranking keys. The routing mechanism isn't miscalibrated; it's the wrong shape. For the additive-loss decomposition: the hybrid-vs-learner advantage factorises into covered mass times a rule-learner risk contrast, and you must report this on both false-non-grant and false-permit loss. On two real policies, most selection rules give opposite verdicts on the two losses. The one configuration favourable on both holds only for one policy, one learner setting, and a narrow band of noise levels. In other words, claims about hybrid routing improving security are highly conditional and rarely reported with both loss dimensions. The integrity posture is strong for this kind of work. Every reported number is regenerable from a released artefact. Exhaustive enumeration over the full relation (up to 794,250 tuples) replaces sampling. Four independent elicitors — including three blind LLM elicitors — provide robustness against single-author bias in deny-set construction. The benchmarks are the public ABAC Lab suite, not custom policies. The broader lesson is a pattern engineers should recognise from other safety-critical ML pipelines: the ML component gets all the testing budget, while the hand-built scaffolding around it — the part everyone assumes is correct because a human wrote it — harbours the worst bugs. This paper doesn't just find bugs; it formalises what 'correct' means for these artefacts and provides the checking machinery.
