Continuous access control group determination

Abstract

A data management server may receive metadata related to data access associated with a domain containing a plurality of named entities. The server determines domain-defined groups, each associated with a domain-defined access rule, and extracts features from the metadata, including access activity data of the named entities accessing domain resources. These features are input into a machine learning model to identify an automatically-generated access-control group comprising one or more named entities. The server determines an access control rule for the generated group based on access activity data and compares it to a domain-defined access rule for a domain-defined grouping containing one of the named entities. Based on this comparison, the server generates a recommendation to modify access privileges for one or more named entities in the group, facilitating enhanced access control aligned with domain-specific policies and security objectives.