Abstract: In some aspects, the techniques described herein relate to a method including: storing, in an application management database, an audit group, wherein the audit group identifies one or more computer applications; querying the application management database, wherein the querying returns a plurality of access control descriptions from the application management database; processing keywords from the plurality of access control descriptions with a machine learning (ML) model to determine a plurality of duty groups; associating access control permissions with the plurality of duty groups based on the keywords; and determining toxic combinations of the access control permissions based on database relationships between the plurality of duty groups, the audit group, and a user identifier.