CARGO — Supplementary Material

This package accompanies the paper CARGO: Towards Row-Level Access Control in Natural Language Database Interfaces (anonymous submission). of Row-Level Security Policies* (anonymous submission). It contains the benchmark data, the full CARGO pipeline code, the prompts used in our experiments, the result tables, and reproduction scripts.

Text-to-RLS-Supplementary/
├── README.md                  ← this file
├── appendix/
│   └── supplementary.pdf      ← extended appendix with derivations & extra figures
├── benchmark/
│   ├── requirements.json      ← 490 natural-language authorization requirements
│   ├── reference_policies/    ← gold CREATE POLICY statements
│   ├── schemas/               ← 8 enterprise schemas (45 tables, 1,707 columns)
│   ├── runtime_context/       ← runtime variable spec + job-role vocabulary
│   └── executable_tests/      ← 3,037 PostgreSQL test cases over 481 evaluable items
├── code/
│   ├── extractor/             ← CodeS-3B + LoRA scope/anchor extractor (train + infer)
│   ├── retrieval/             ← Top-K reranker + Constraint-Guided ICL retrieval
│   ├── generation/            ← Frozen-LLM CREATE POLICY generator
│   └── evaluation/            ← RLSbench evaluation harness (7 metrics)
├── prompts/
│   ├── cargo_prompt.txt       ← canonical CARGO 5-shot prompt template
│   └── baseline_prompts/      ← 0-shot · random · StructICL prompt JSONs
├── results/
│   ├── main_results.csv       ← Table V — 7 metrics × 9 baselines + CARGO
│   ├── ablation_results.csv   ← Tables VI/VII — pipeline & backbone ablations
│   └── per_item_results/      ← per-item pass/fail JSONs for the key configurations
└── scripts/
    ├── setup_database.sh      ← initialise PostgreSQL and load schemas
    ├── run_evaluation.sh      ← evaluate any predictions.json against RLSbench
    └── reproduce_tables.sh    ← regenerate main_results.csv & ablation_results.csv

Quick start

# 1. Initialise PostgreSQL + load the 8 enterprise schemas
./scripts/setup_database.sh rlsbench

# 2. Reproduce the headline tables from the shipped per-item JSONs
./scripts/reproduce_tables.sh

# 3. Evaluate a fresh CARGO run against RLSbench
./scripts/run_evaluation.sh results/per_item_results/my_predictions.json rlsbench

CARGO pipeline (Algorithm 2)

NL requirement N + schema Σ + runtime context Ω
        │
[code/extractor/]   ──► CodeS-3B + LoRA (cascade, λ=0.4) produces (Ŝ, Â) top-K=3
        │
[code/retrieval/rerank/]  ──► schema-validity + decoding + parsimony  →  (Ŝ★, Â★)
        │
[code/retrieval/icl/]     ──► op-routed pool + MMR (k=5, μ=0.3)        →  R⁽ᵏ⁾
        │
[code/generation/]        ──► frozen DeepSeek-V3.2 produces CREATE POLICY …
        │
[code/evaluation/]        ──► run 3,037 tests → PCS / BA / IA / OPR / UPR / Sec@0FP / DDeny

Benchmark in numbers

Headline result

See results/main_results.csv for the full 7-metric × 9-system table.

Reproducibility notes

• All experiments use PyTorch 2.4 with bf16 mixed precision; the extractor is fine-tuned for 4 epochs on 2×RTX 5090.
• The frozen generator runs at temperature 0 with a 4,096-token output budget.
• Constraint-Guided ICL uses k=5 demonstrations selected by operation-routed MMR with μ=0.3.
• The Top-K reranker uses beam width B_S=B_A=3, with K=3 final candidates (Figure 4 confirms saturation at K=3).
• All metrics are computed by code/evaluation/evaluate.py directly from the test-case execution traces in results/per_item_results/.

License & contact

Code is released under the MIT License; data under CC-BY-4.0. Contact the authors via the submission system.