一句话：提出首个 Rego 策略缺陷基准 RegoBench 与多智能体修复框架 RegoMender，显著提升自动修复成功率。
Policy-as-Code 在云原生系统中日益重要，但 Rego 策略因语法严格、声明式语义和特定验证要求，自动修复仍依赖人工试错，现有 APR 方法难以适配。本文提出首个 Rego 策略自动修复基准 RegoBench，含 1,159 个真实缺陷；并提出反馈引导的多智能体框架 RegoMender，通过共享黑板与原子工具集协同，动态执行打补丁、重写或回滚以处理复杂修复。在 RegoBench 上，其语法与测试语义成功率分别为 82.9% 和 77.9%，超过最强基线 13.4%；在单步与链式任务中保持有效，并可泛化到 HCL 和 SQL，在 132 个真实 CVE 上修复率达 86.4%。
Policy-as-Code (PaC) has emerged as a foundational paradigm in cloud-native systems. However, repairing Rego policies remains challenging due to their strict syntax, declarative semantics, and specific verification requirements. Existing automated program repair (APR) methods are mainly designed for mainstream languages and struggle to accommodate the unique policy logic and repair workflows of Rego. Thus, Rego policy repair remains a manual process driven by trial and error. To address this, we introduce RegoBench, the first automated Rego policy benchmark comprising 1,159 real-world defects, and propose RegoMender, a feedback-guided multi-agent framework. Collaborating via a shared blackboard and an atomic toolkit, RegoMender dynamically executes patching, rewriting, or rolling back, to resolve complex repair scenarios. Evaluated on RegoBench, RegoMender achieves syntactic and test-based semantic success rates of 82.9% and 77.9%, respectively, outperforming the strongest baseline by 13.4%. Unlike other approaches whose performance drops in complex scenarios, RegoMender maintains effectiveness across single-step and chained repair tasks. Furthermore, it generalizes strongly across HCL and SQL and achieves an 86.4% repair rate on 132 real-world CVE vulnerabilities, proving its robustness and practical utility for security.
@inproceedings{paperbot12429,
title = {RegoMender: A Multi-agent Framework for Automated Rego Policy Repair},
author = {Ruijie Zhang and Huaxiao Yin and Li Hu and Fanqi Kong and Haozhe Liang and Shaoyin Cheng and Kun Zhang and Bibo Tu},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837490}
}