DETAILED ACTION
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This Office Action is in response to the communication filed on 03/11/2026.
Claim 3 has been cancelled.
Claims 1-2, 4-6, 8-10, 12-13, and 16-18 have been amended.
Claims 1-2 and 4-20 are pending for consideration.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Regarding the 112 2nd rejection of claims 2, 10, 18, 4, 12, 5, 13, 8 and 16, Applicant has amended these claims. Therefore, the rejection has been withdrawn.
Regarding the 101 rejection of claims 1-20, Applicant’s arguments have been fully considered and are persuasive. Therefore, the rejection has been withdrawn.
Applicant’s arguments with respect to claims 1-2 and 4-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2 and 4-20 are rejected under 35 U.S.C. 103 as being unpatentable over Maschmeyer et al. (U.S. 12,468,878)(hereinafter Maschmeyer) in view of Kunchakarra et al. (U.S. 12,541,726)(hereinafter Kunchakarra).
Regarding claims 1, 9, 11, 17 and 19, Maschmeyer teaches an automated access description generation system, comprising:
a processor; a non-transitory, computer-readable storage medium (Maschmeyer: see Col 26 lines 57-62, “In some embodiments, and as described further herein, the e-commerce platform 100 may be implemented through a processing facility. Such a processing facility may include a processor and a memory. The processor may be a hardware processor. The memory may be and/or may include a non-transitory computer-readable medium”, including computer instructions for:
receiving a request to generate a description (Maschmeyer: see Col 20 lines 54-58, "The UI 600 may as in the example shown in FIG. 3A, include an autofill option 616 that may be selected to cause the text-editor 550 to assist in completion of the generated description 612, as will be discussed further below with respect to FIGS. 3C and 3D");
providing a prompt to a large language model models (LLM), the prompt specifying one or more rules for the LLM to follow when generating the description for the access entitlement (Maschmeyer: see Col 2 lines 33-40, "...generate a prompt to a large language model (LLM) to generate a description of an object, the prompt including one or more object attributes to include in the generated description, and also including an instruction for the LLM to annotate, according to a defined format, any portions of the generated description that include unsubstantiated information; provide the prompt to the LLM..");
generating the description of the access entitlement using the LLM based on the prompt (Maschmeyer: see Col 36 claim 1 lines 12-14, "provide the prompt to the LLM; causing the LLM to generate the generated description; receive the generated description"; Kunchakarra: see Col 64 lines 50-56, "The processor, in association with the large language models, generates the one or more job descriptions based on at least one of the organizational structure, the one or more roles, the one or more responsibilities, the one or more hierarchical relationships, the one or more access levels, the one or more service actions, and the one or more departments"); and
presenting, over a graphical user interface, the generated description of the access entitlement (Maschmeyer: see Col 2 lines 43-44, "...and present the generated description for display via a user device").
However, Maschmeyer does not explicitly teach an access entitlement in an identity governance and administration; storing context information about specific entitlements in a knowledge base;
retrieving context information relating to the access entitlement stored in the knowledge base; providing context information with the prompt to the large language model; and generating the description of the access entitlement using the LLM based on the retrieved context information for an access entitlement in an identity governance and administration.
Nevertheless, Kunchakarra-which is in the same field of endeavor- teaches
storing context information about specific entitlements in a knowledge base (Kunchakarra: see Col 56 lines 2-8, "The system also receives feedback from the users to report inaccuracies and provide suggestions for improvement. The system also regularly updates the training dataset and retrains the model to adapt to evolving security policies and organizational changes, privacy and security standards, policies, and procedures including industry best practices");
retrieving context information relating to the access entitlement stored in the knowledge base (Kunchakarra: see Col 75 lines 64-67, "extracting one or more contents related to an organization from one or more data sources based on one or more job role names and one or more contextual inputs (at step 1603)");
providing context information with the prompt to the large language model (Kunchakarra: see Col 64 lines 50-56, "The processor, in association with the large language models, generates the one or more job descriptions based on at least one of the organizational structure, the one or more roles, the one or more responsibilities, the one or more hierarchical relationships, the one or more access levels, the one or more service actions, and the one or more departments
generating the description of the access entitlement using the LLM based on the retrieved context information for an access entitlement in an identity governance and administration (Kunchakarra: see Col 64 lines 50-56, "The processor, in association with the large language models, generates the one or more job descriptions based on at least one of the organizational structure, the one or more roles, the one or more responsibilities, the one or more hierarchical relationships, the one or more access levels, the one or more service actions, and the one or more departments").
Maschmeyer and Kunchakarra are analogous art because they are from the same field of endeavor. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine Maschmeyer’s prompt generation technique for a generated description using large language model with Kunchakarra’s method for identifying excessive privileges in an Identity and Access Management System. The suggestion/motivation for doing so would be to improve the quality, reliability, and specificity of the security information associated with industry standards and remove redundancy in organizational hierarchies that may provide privileges that aren’t approved or necessary.
Regarding claims 2, 10, and 18, Maschmeyer teaches the prompt provided to the LLM includes one or more of: a string identifier, a source of the access entitlement, and roles of users who have access to the access entitlement (Maschmeyer: see Col 14 lines 34-42, "For example, the object database 560 may include, for each object, data about one or more object attributes (e.g., object name, object size, object type, object features, etc.). Object attribute(s) for a given object may for example, be stored in a lookup table that can be referenced using the name of the object, a unique identifier (e.g., identification number) of the object, etc. Each object attribute of a given object may be stored as a text string (which may include one or more words)"); Col 16 lines 46-47, "The prompt generator 500 performs operations to generate a prompt to a LLM to generate the object description, where the prompt includes the object attribute(s) that should be included in the generated description").
Regarding claims 4 and 12, Maschmeyer and Kunchakarra teach the context information relating to the access entitlement includes information about an organization (Kunchakarra: see Col 62 lines 43-49, "In one embodiment, the one or more contents comprise at least one of one or more security contents and one or more organizational structural contents"..."In one embodiment, the one or more data sources, from which the contents extracted, are related to the organization"). Motivation to combine Maschmeyer and Kunchakarra in the instant claims is the same as that in claims 1, 9, and 17.
Regarding claims 5 and 13, Maschmeyer and Kunchakarra teach the context information relating to the access entitlement includes information about an organization the context information relating to the access entitlement includes information about an industry (Kunchakarra: see Col 62 lines 52-60, "The one or more data sources comprise at least one of databases, object stores, document management system, file systems, and through application programming interfaces. In an embodiment, the job role names and the one or more contextual inputs may be fed as an input query to the processor. The contextual inputs may comprise organizational inputs. The contextual inputs comprise at least one of an organization size, an industry, a field, a tier classification, and employee count"). Motivation to combine Maschmeyer and Kunchakarra in the instant claims is the same as that in claims 1, 9, and 17.
Regarding claims 6 and 14, Maschmeyer teaches providing feedback from a reviewer of the description generated by the LLM to the knowledge base (Maschmeyer: see Col 19 lines 46-47, "The generated description is received from the LLM and may be presented to a user device"; Col 19 lines 54-55, "The text-editor 550 may provide a UI that enables a user to review the generated description"; Col 20 lines 59-65, "The UI 600 may include an accept option 618 that may be selected to confirm that the generated description 612 (which may have been modified by the user, for example to provide the unsubstantiated information) is approved. Selection of the accept option 618 may cause the generated description 612 (with the user modifications that have been made) to be saved by the platform").
Regarding claims 7, 15, and 20, Maschmeyer teaches fine-tuning the LLM using training data (Maschmeyer: see Col 8 lines 33-40, "In some examples, a trained ML model may be fine-tuned, meaning that the values of the learned parameters may be adjusted slightly in order for the ML model to better model a specific task. Fine-tuning of a ML model typically involves further training the ML model on a number of data samples (which may be smaller in number/cardinality than those used to train the model initially) that closely target the specific task"), the training data including a plurality of input/output pairs (Maschmeyer: see Col 7 lines 45-54, "The training data may be a subset of a larger data set. For example, a data set may be split into three mutually exclusive subsets: a training set, a validation (or cross-validation) set, and a testing set. The three subsets of data may be used sequentially during ML model training. For example, the training set may be first used to train one or more ML models, each ML model, e.g., having a particular architecture, having a particular training procedure, being describable by a set of model hyperparameters, and/or otherwise being varied from the other of the one or more ML models"; Col 7 lines 65-67 Col 8 lines 1-5, "Once such a trained ML model is obtained (e.g., after the hyperparameters have been adjusted to achieve a desired level of performance), a third step of collecting the output generated by the trained ML model applied to the third subset (the testing set) may begin. The output generated from the testing set may be compared with the corresponding desired target values to give a final assessment of the trained ML model's accuracy").
Regarding claims 8 and 16, Maschmeyer and Kunchakarra teach the input/output pairs include training data including one or more of: an identifier of the access entitlement, a source application of the access entitlement, roles of users who have access to the access entitlement, and activity data about usage of the access entitlement (Kunchakarra: see Col 7 lines 44-51, "annotating the one or more custom datasets by highlighting the one or more roles, and the one or more service actions and the one or more access levels, respectively; and training the artificial intelligence engine/large language models) using the one or more custom datasets"; Col 68 lines 49-54, "annotating the one or more custom datasets by highlighting the one or more roles, and the one or more service actions and the one or more access levels, respectively; and training the artificial intelligence engine/large language models) using the one or more custom datasets"). Motivation to combine Maschmeyer and Kunchakarra in the instant claims is the same as that in claims 1, 9, and 17.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KELAH JANAE MCFARLAND-BARNES whose telephone number is (571)272-5953. The examiner can normally be reached Monday through Friday 8:00am until 4:00pm Central Time.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn D Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KELAH JANAE MCFARLAND-BARNES/Examiner, Art Unit 2431
/LYNN D FEILD/Supervisory Patent Examiner, Art Unit 2431
Prosecution Insights