TECHNICAL FIELD

Embodiments relate generally to managing user access permissions, and, more specifically, to techniques for automatically adjusting permission data via cluster-based learning.

BACKGROUND

The approaches described in this section are approaches that could be pursued, but not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.

Computer systems typically implement some form of access control, via which access to certain types of operations is granted or denied depending on permissions associated with a user who is requesting the operations. Depending on the system, permissions may govern access to anything from individual file editing operations to operations of large-scale distributed computing applications. Permissions can be assigned to users at an individual level, or permissions can be assigned to groups. In the latter case, the permissions of a user are a function of the group or groups to which the user belongs.

Users may have varying levels of permissions depending on their role within an organization that operates the computer system. For instance, an IT employee might have permissions to access to different applications and/or operations within those applications than an administrative assistant or a vice president. In this manner, among other aspects, the computer system reduces the risk of security breaches whereby untrained or rogue employees, computer viruses or other malware, malicious hackers, or other entities gain unauthorized access to the information in and/or functions of the computing system and inadvertently or deliberately take actions that damage the system and/or the organization.

As an organization develops and grows over time, the complexity of the computing system tends to grow as well. Additional applications, operations, and permissions may be added to the system. Furthermore, the roles and needs of various users may change over time. It can be difficult to plan the permissions of hundreds, thousands, or even millions of users at any instant of time, much less react to changes over time. Because of this complexity, users are often assigned a greater number of permissions than needed. Moreover, users often retain permissions that were needed in a previous role but are no longer needed. Consequently, the computing system is exposed to greater security risks than is desirable.

