Context-Aware Temporal Defeasible Logic Framework for Risk-Based Access Control in Zero Trust Architecture

Abstract

Dynamic and regulated environments require remote access to sensitive resources via heterogeneous devices and diverse networks governed by complex access control policies. These environments change continuously, threats may evolve during authenticated sessions, increasing the risk of security breaches and unauthorized access. Consequently, transparent, explainable, and verifiable access decisions are essential even in the presence of policy conflicts. Although adaptive risk-based access control models are context-sensitive and derive access decisions based on surrounding environmental conditions, they often produce access decisions that cannot be traced or justified. Moreover, these models rely on classical monotonic reasoning which are insufficient for detecting or resolving simultaneously applicable conflicting policies. In addition, most risk-based approaches also lack principled enforcement of zero trust architecture principles: such as least privilege access proportional to evaluated risk, continuous verification of evolving context, and no implicit trust in previously granted access. This paper introduces a Context-aware Temporal Defeasible Logic framework for risk-based access control (CTDL-RAC) which formally integrates adaptive risk evaluation to derive graduated, context-sensitive risk outcomes mapped to proportional access responses. The framework employs a Context-aware, Temporal Defeasible Logic (CTDL) reasoning engine to handle conflicting policies transparently and generate policy-traceable access decisions. Zero Trust principles are enforced through continuous, formally re-derived access decisions that remain aligned with the current security state. The framework is implemented in a healthcare setting and tested in an SWI-Prolog prototype, demonstrating policy compliance, conflict resolution, and explainable decision derivation.