Abstract: The system and method of visual role engineering uses a visual assessment tool to identify clusters of users and to define roles. A “cluster image” is generated that visually depicts the cluster tendencies of users and permissions. An operator of the visual assessment tool can visually identify clusters of users with the same permissions. The operator may select a cluster representing a subset of users, define a role for the subset of users, and assign permissions to the role. The process may be repeated in an iterative fashion until it is determined that no more roles are needed.

Abstract: Methods and computer program products for analyzing privilege usage are disclosed. Event information is identified for each user, including a list of events and a count of each listed event. Privilege information of each user is identified, including a list of privileges of the user. The event information and privilege information of users with similar events are compared. Events are mapped to privileges based on the comparison to generate an event-privilege mapping. Users with similar counts for similar events may be used for comparison. A computer system is disclosed that includes an event identifier, a privilege identifier and an event-privilege mapper.

Abstract: The system and method of visual role engineering uses a visual assessment tool to identify clusters of users and to define roles. A “cluster image” is generated that visually depicts the cluster tendencies of users and permissions. An operator of the visual assessment tool can visually identify clusters of users with the same permissions. The operator may select a cluster representing a subset of users, define a role for the subset of users, and assign permissions to the role. The process may be repeated in an iterative fashion until it is determined that no more roles are needed.