Abstract: The disclosed embodiments relate to the design of a system that manages access rights for an EMR system. During operation, the system receives a request to provision access rights for a user of the EMR system. In response to the request, the system performs a mapping operation that checks the request against attributes of the user to determine the user's access rights in the EMR system. If the request generates an exception, the system presents the request to an analyst to handle the exception. If the request does not generate an exception, the system automatically approves the request.