Abstract: Certain aspects of the disclosure provide techniques for access control policy management. A method generally includes factorizing a user access co-occurrence data element to generate two data sub-elements, wherein: the user access co-occurrence data element represents co-occurrences between users of a system and resources of the system, a product of the two data sub-elements approximates the user access co-occurrence data element, and each of the two data sub-elements has reduced dimensionality compared to the user access co-occurrence data element; generating an approximated user access co-occurrence data element based on the product of the two data sub-elements; comparing the user access co-occurrence data element and the approximated user access co-occurrence data element to determine one or more anomalies, wherein each of the one or more anomalies relates to access for a user to a resource of the system; and taking one or more actions to rectify the one or more anomalies.

Abstract: Certain aspects of the disclosure provide techniques for access control policy management. A method generally includes factorizing a user access co-occurrence data element to generate two data sub-elements, wherein: the user access co-occurrence data element represents co-occurrences between users of a system and resources of the system, a product of the two data sub-elements approximates the user access co-occurrence data element, and each of the two data sub-elements has reduced dimensionality compared to the user access co-occurrence data element; generating an approximated user access co-occurrence data element based on the product of the two data sub-elements; comparing the user access co-occurrence data element and the approximated user access co-occurrence data element to determine one or more anomalies, wherein each of the one or more anomalies relates to access for a user to a resource of the system; and taking one or more actions to rectify the one or more anomalies.

Abstract: At least one processor of a central authority separate from a computing process may establish a first trust relationship between the computing process and a central authority separate from the computing process. The establishing may include authenticating the computing process, which may include providing a signed token to the computing process, receiving a request for the certificate from the computing process including the signed token and policy ID data, determining that the computing process is eligible for the certificate according to a policy that associates the certificate with the policy ID data, and validating the signed token. In response to the establishing, the at least one processor may obtain the certificate. The certificate may be signed by a third-party certificate authority with which the central authority has a second trust relationship separate from the first trust relationship. The at least one processor may provide the certificate to the computing process.

Abstract: At least one processor of a central authority separate from a computing process may establish a first trust relationship between the computing process and a central authority separate from the computing process. The establishing may include authenticating the computing process, which may include providing a signed token to the computing process, receiving a request for the certificate from the computing process including the signed token and policy ID data, determining that the computing process is eligible for the certificate according to a policy that associates the certificate with the policy ID data, and validating the signed token. In response to the establishing, the at least one processor may obtain the certificate. The certificate may be signed by a third party certificate authority with which the central authority has a second trust relationship separate from the first trust relationship. The at least one processor may provide the certificate to the computing process.