From Static Roles to Context-Aware Decisions: Integrating LLMs and RAG Into Access Control Frameworks for Power Systems

Access control is a critical security mechanism in power systems. Role-Based Access Control (RBAC) is widely adopted due to its simplicity and interpretability, but it struggles to adapt to dynamic user behavior and evolving security risks. Although context-aware access control models extend RBAC by incorporating predefined contextual conditions, they still rely heavily on explicit context modeling, which is difficult to maintain under complex and evolving operational scenarios. In this paper, we propose a context-aware access control framework that integrates Large Language Models (LLMs) with Retrieval-Augmented Generation (RAG) on top of an RBAC backbone. Unlike conventional context-aware approaches that depend on manually defined context attributes or rules, the proposed framework infers implicit, behavior-derived contextual semantics by reasoning over unstructured access logs and retrieving relevant historical behavior records. This design enables more flexible and adaptive authorization decisions while preserving the interpretability of RBAC. Experimental results on a synthetic power system access control dataset demonstrate that the RAG-enhanced framework consistently outperforms static RBAC baselines, particularly in handling ambiguous or borderline access requests. The results highlight the effectiveness of LLM-based contextual reasoning as a complementary mechanism for enhancing access control in dynamic power system environments.