AWS has made public a method for semantically comparing formal policies: first identify the common structure between two policies, then isolate the parts that differ in actual behavior. We find that it comes closer than ordinary text diffing to the genuinely difficult part of code review—judging whether a change alters meaning.
What this is
Formal policies translate requirements such as “only the owner, with approval, may modify a resource” into rules that systems can enforce and verify. AWS’s open-source engine uses anti-unification—finding the most specific common pattern between two expressions—and an e-graph, which records equivalent expressions and the rules under which they apply, to calculate semantic differences.
A typical scenario is an LLM translating natural-language requirements into policy languages such as SMT-LIB, Cedar, Dogwood, OpenShell, or CEL. A model may produce a different result on each run, while manual line-by-line review is both slow and prone to missing critical changes such as replacing “and” with “or.” Semantic diffing can present the stable portions first, then route the differing portions to human review.
Industry view
The value here is not in automatically approving AI-generated code for enterprises, but in providing an auditable verification layer. AWS explicitly notes that the LLM generates the formal result and does not calculate the differences; this separation of generation from verification is well suited to environments with demanding permission, security, and compliance requirements.
But it cannot serve as a direct guarantee of correctness. The engine can only prove that policies are equivalent under the given rules; if the rules are incomplete or the search space is insufficient, unrecognized equivalences may remain. Differences may also arise because the rules themselves are wrong, rather than because the model made an error. Semantic diffing can therefore reduce review burden, but it cannot replace domain experts, testing, or clear allocation of security responsibility.
Impact on regular people
For enterprise IT: Enterprises can more confidently let LLMs participate in permission rules and policy configuration, but they still need to retain human approval and include rule changes in audit records.
For individual professionals: People who understand business requirements but not necessarily formal languages will increasingly be responsible for confirming whether AI-generated rules match the intended outcome; the technical barrier falls, while responsibility boundaries become clearer.
For the consumer market: This approach is unlikely to become a mass-market product in the short term, but it could reduce permission-configuration errors and compliance incidents in enterprise applications, enabling AI features to enter sensitive systems such as financial and healthcare services more cautiously.