Abstract
A platform that began with a flat set of boolean capabilities (CANUSELLM, CANMANAGEUSERS, …) and a few flat roles must eventually migrate to fine-grained, scoped RBAC where permissions are domain:resource:action tuples and roles are wildcard-composable pattern sets. The conventional path is a hand-maintained translation table plus a flag-day cutover, both of which are labor-intensive and risky: a single mis-mapping is a production outage or a silent privilege escalation. This publication discloses a mechanism that (1) heuristically translates each legacy capability into a fine-grained permission — explicit override map first, then a structural parse of the CAN
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Assuncao, gustavo matthew, "Heuristic Capability-to-RBAC Translator with Dual-Read Shadow Evaluation", Technical Disclosure Commons, (July 13, 2026)
https://www.tdcommons.org/dpubs_series/10866