NLP-Driven Zero Trust: Automating Security Policy Generation and Access Review via Semantic Analysis of Operational Manuals in Critical Infrastructure

Implementing Zero Trust (ZT) architecture in Critical Infrastructure (CI) is paramount to securing Cyber-Physical Systems (CPS) against sophisticated threats.However, defining granular, least-privilege access policies in these environments is severely hampered by the reliance on heterogeneous, unstructured operational manuals that dictate legitimate procedures.Manual policy derivation from these documents is error-prone, unscalable, and often results in static "over-privileging," violating ZT principles.This paper presents a novel framework utilizing advanced Natural Language Processing (NLP) to automate the extraction of semantic relationships from technical operational manuals to dynamically generate Attribute-Based Access Control (ABAC) policies.We propose a hybrid methodology combining domain-specific Named-Entity Recognition (NER) with Transformer-based Semantic Role Labeling (SRL) to identify actors, actions, assets, and contextual constraints within procedural text.We formulate a mathematical model for mapping extracted semantic triples into formal ZT policy specifications.Simulation results demonstrated a 92.5% F1score in extracting policy-relevant entities and a 78% reduction in time required for access reviews compared to manual baselines.This research provides a scalable pathway for bridging the gap between static documentation and dynamic security enforcement in safety-critical environments.