Role management framework using graph analytics

Abstract

An identity and access management method for role mining is disclosed, involving storing in a database data including at least one of user identity attributes, enterprise roles, entitlements for each role, users for each role, resource-usage events, and key performance indicators. A processor-based role design and calibration engine retrieves a set of roles, and the processor computes, for each role, key performance indicators including at least one of in-role access percentage, out-of-role access percentage, missing entitlement count, unused entitlement count, or user count. A role quality score is derived for each role using the indicators. If the score is equal to or above a threshold, the role is kept and the indicators stored in the database. If the score is below the threshold, the method mines for potential new roles, compares them to existing roles, and proposes at least one change. A corresponding system is also disclosed.