ReATest: enhancing policy-as-code workflows through automated test case generation from Rego policies

ReATest: enhancing policy-as-code workflows through automated test case generation from Rego policies | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article ReATest: enhancing policy-as-code workflows through automated test case generation from Rego policies Thanh-Binh Trinh, Ngoc-Minh Le This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9109366/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 9 You are reading this latest preprint version Abstract Policy-as-code (PaC ) has emerged as a key practice in development, security, and operations, enabling organizations to specify, manage, and enforce access control policies as part of the software delivery pipeline. At the core of PaC, Rego, the policy language of the Open Policy Agent, has been widely adopted to implement fine-grained and flexible authorization rules acrosscloud-native and microservice-based environments. However, testing Regopolicies remains a major challenge, as current practices rely heavily on manual or ad-hoc test case design, often leading to insufficient coverage and latentsecurity risks. This article introduces ReATest, an automated approach to enhancing PaC workflows through systematic test case generation from Rego specifications. ReATest defines a specialized Rego Flow Graph that capturesthe semantics of Rego rules, conditions, and policy decisions. It then systematically explores execution paths to ensure comprehensive coverage. To optimize the generated test suite, the Grey Wolf Optimization algorithm isemployed, reducing redundancy while maximizing coverage. The approachhas been evaluated on realistic Rego policies from open-source repositoriesand industrial case studies. Experimental results show that ReATest achievedan average 35.43% reduction in test suite size while maintaining 64.57% transition coverage; overall, this corresponds to 69.77% fewer tests compared tothe published baselines. This improvement enhances the reliability and efficiency of PaC workflows in real-world applications. Policy-as-code Rego policies Open Policy Agent automated test case generation policy verification Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Reviewers agreed at journal 15 May, 2026 Reviews received at journal 11 May, 2026 Reviews received at journal 05 May, 2026 Reviewers agreed at journal 15 Apr, 2026 Reviewers agreed at journal 07 Apr, 2026 Reviewers invited by journal 06 Apr, 2026 Editor assigned by journal 18 Mar, 2026 Submission checks completed at journal 18 Mar, 2026 First submitted to journal 12 Mar, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9109366","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":618688936,"identity":"7e45a952-2543-4e72-a1d0-5363d18f829e","order_by":0,"name":"Thanh-Binh Trinh","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABR0lEQVRIie2Qv0vDQBTHXwkky1XXK7H2X7hQSChV+69cCDRLooOLoOBBIJPS1aF/hJt2MnIQl/sDbhDJlEkhk9RB8ZJWiK0/VsF8lvty733ePQ6goeEPQjTQyxMBrkKyrQIATRZldWhfK7RUtErp/67AQoEPxWV42btkTXGMdpq15g9bjjlJs5fre//KjNIsE3s9wOFtAkdDNSRMasog2vAJ0EM0mHLDOhd5OJumPqHSsxjeV/sJ3y1DfTGObAyUIiI9HbdjHl7KwMa00Fo3MiBJK+YuQ4J8p3ReY+4TefCslNMRw6Xy9rNiqlcokYGOqVSdlcJUMM7qyiBSCh1Xim12Y27NLsbqRtx5DD2ShKZ+P/6sOJvCxsUOHRHp5p2nmPcc7OWdeXq8y4ygXxQnw+5EQ3Wlov4fQNZK+mr/KmsDGxoaGv49704BfMzfEkPLAAAAAElFTkSuQmCC","orcid":"","institution":"Phenikaa University","correspondingAuthor":true,"prefix":"","firstName":"Thanh-Binh","middleName":"","lastName":"Trinh","suffix":""},{"id":618688938,"identity":"ff3f2239-0320-48ed-adc8-97ed4c832425","order_by":1,"name":"Ngoc-Minh Le","email":"","orcid":"","institution":"Hai Phong University","correspondingAuthor":false,"prefix":"","firstName":"Ngoc-Minh","middleName":"","lastName":"Le","suffix":""}],"badges":[],"createdAt":"2026-03-13 02:24:01","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9109366/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9109366/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":106726504,"identity":"d16925ec-50e7-4b8b-a560-fc3041ce6308","added_by":"auto","created_at":"2026-04-12 18:36:22","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":549472,"visible":true,"origin":"","legend":"","description":"","filename":"BinhttReAtest.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9109366/v1_covered_8e2c8b5e-ddd0-4741-8068-8d5ecb0e4e3f.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"ReATest: enhancing policy-as-code workflows through automated test case generation from Rego policies","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"software-quality-journal","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"sqjo","sideBox":"Learn more about [Software Quality Journal](http://link.springer.com/journal/11219)","snPcode":"11219","submissionUrl":"https://submission.nature.com/new-submission/11219/3","title":"Software Quality Journal","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Policy-as-code, Rego policies, Open Policy Agent, automated test case generation, policy verification","lastPublishedDoi":"10.21203/rs.3.rs-9109366/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9109366/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Policy-as-code (PaC ) has emerged as a key practice in development, security, and operations, enabling organizations to specify, manage, and enforce access control policies as part of the software delivery pipeline. At the core of PaC, Rego, the policy language of the Open Policy Agent, has been widely adopted to implement fine-grained and flexible authorization rules acrosscloud-native and microservice-based environments. However, testing Regopolicies remains a major challenge, as current practices rely heavily on manual or ad-hoc test case design, often leading to insufficient coverage and latentsecurity risks. This article introduces ReATest, an automated approach to enhancing PaC workflows through systematic test case generation from Rego specifications. ReATest defines a specialized Rego Flow Graph that capturesthe semantics of Rego rules, conditions, and policy decisions. It then systematically explores execution paths to ensure comprehensive coverage. To optimize the generated test suite, the Grey Wolf Optimization algorithm isemployed, reducing redundancy while maximizing coverage. The approachhas been evaluated on realistic Rego policies from open-source repositoriesand industrial case studies. Experimental results show that ReATest achievedan average 35.43% reduction in test suite size while maintaining 64.57% transition coverage; overall, this corresponds to 69.77% fewer tests compared tothe published baselines. This improvement enhances the reliability and efficiency of PaC workflows in real-world applications.","manuscriptTitle":"ReATest: enhancing policy-as-code workflows through automated test case generation from Rego policies","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-04-10 12:52:32","doi":"10.21203/rs.3.rs-9109366/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"reviewerAgreed","content":"179562074850055677437995212437655527212","date":"2026-05-15T14:54:12+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-05-11T09:25:42+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-05-05T17:30:16+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"66918418846242715219251252774401942241","date":"2026-04-15T09:00:36+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"5860837839399694199580869521721506256","date":"2026-04-07T07:02:57+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-04-06T09:34:51+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-03-19T01:47:58+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-03-19T01:47:35+00:00","index":"","fulltext":""},{"type":"submitted","content":"Software Quality Journal","date":"2026-03-13T02:18:18+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"software-quality-journal","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"sqjo","sideBox":"Learn more about [Software Quality Journal](http://link.springer.com/journal/11219)","snPcode":"11219","submissionUrl":"https://submission.nature.com/new-submission/11219/3","title":"Software Quality Journal","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"8c56f5ea-edd1-4192-a713-130d9bf7cd54","owner":[],"postedDate":"April 10th, 2026","published":true,"recentEditorialEvents":[{"type":"reviewerAgreed","content":"179562074850055677437995212437655527212","date":"2026-05-15T14:54:12+00:00","index":25,"fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-05-11T09:25:42+00:00","index":21,"fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-05-05T17:30:16+00:00","index":20,"fulltext":""}],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-04-10T12:52:32+00:00","versionOfRecord":[],"versionCreatedAt":"2026-04-10 12:52:32","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9109366","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9109366","identity":"rs-9109366","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}