Abstract: A method for controlling access to a resource in a resource set includes, for each member of an organization, retrieving a member-attribute set and a member-permission set. The member-attribute set includes attributes of the member and the member-permission set includes a permission that indicates whether that member is entitled to use that resource. The method continues with defining a global attribute-set and defining a set of profiles. The global attribute-set is a union of the member-attribute sets and each profile is a proper subset of the global attribute-set. Each profile has a profile population that consists of those members whose attributes are a superset of those in the profile. These profiles, in aggregate, cover a predefined fraction of the members.