Abstract: Certain aspects of the present disclosure provide techniques for adjusting access control policies of access controlled systems, such as techniques for identifying a vulnerability or for identifying parameters and values achieving a specified result from a system whose access is controlled by the policy. Requests to the system can be made using a testing system that executes test scripts using avatars having various parameter types and values. The avatar information and results of the test scripts are provided as training data to a machine learning model training system to generate a model that provides recommendations for parameter types and values likely to achieve a particular result. The recommendations are used to execute the test script to determine results including a rate of success for the recommended parameters and/or values. Various actions, such as adjusting or adding a rule to an access control policy, can be performed based on the results.