Abstract: In one embodiment the present invention includes a computer-implemented method comprising retrieving user account data records from an external system. Each user account data record comprises actions a user is authorized to perform in the external system, and for each action, permissible data manipulation activities the user is capable of performing for a corresponding action. Risk analysis rules may be applied against the user account data records. Each risk analysis rule may include different function-based sub-rules. Each risk analysis rule may apply a different function-based sub-rule to each different action in a particular user account data record, and each function-based sub-rule may be verified based on a particular action and the permissible data manipulation activities associated with said particular action. The risk analysis rule is verified if all of the different function-based sub-rules for the different actions are verified.