Access Modeling

Every entitlement assignment carries an implicit question: should this end user have this access? At enterprise scale, no reviewer can independently evaluate every single access assignment from scratch. Confidence scores provide the answer empirically.

Identity Governance analyzes your workforce data, for example job function, department, location, cost center, and other HR attributes, alongside existing entitlement assignments. It discovers which combinations of attributes reliably predict which entitlements. For each user-entitlement pair, the confidence score answers a simple question: of all employees who share this end user’s relevant attributes, what percentage also hold this entitlement? A score of 0.93 means 93% of comparable employees have this access. A score of 0.12 means almost no one with this end user’s profile has it.

Identity Governance computes the score from observed data across your entire population. It reflects actual provisioning patterns rather than any single approver’s judgment or any one team’s interpretation of policy. High-confidence assignments are consistent with how the organization actually operates. Low-confidence assignments warrant review.

The same mechanism powers access recommendations. When an end user joins or changes roles, Identity Governance evaluates their updated attributes against known patterns and surfaces entitlements where confidence exceeds your configured threshold and the access their peers already have.

Organizations pursue automated access modeling (or role mining) for two reasons. First, manual role engineering doesn’t scale to large enterprises. You can’t realistically define and maintain roles for 50,000 users and 15,000 entitlements through workshops, interviews, and spreadsheets. Automated mining turns a months-long consulting exercise into a repeatable process that covers the entire organization.

Second, access landscapes drift. People change jobs or transfer, new applications come online, and entitlements pile up. Roles that accurately described access six months ago might no longer match reality. Periodic re-mining compares newly discovered role candidates to your active roles. It flags where role definitions no longer match what the data supports and highlights new patterns that justify new roles. This gives role owners a structured, data-driven basis for governance decisions, instead of relying on periodic manual audits.

Confidence scores tell you whether an individual assignment is expected. Access modeling answers the next question: which assignments belong together?

The term "top-down" here doesn’t mean someone designs roles from an organization chart and pushes them out. It means Identity Governance starts discovery from organizational attributes. HR attributes, such as department, location, and job code, act as the explanatory variables. Access is what gets explained. It asks: given these attributes, what access does the data predict? Access modeling is still a data-driven discovery process, but it’s anchored in the structure the business already uses to describe its workforce.

The system looks at all discovered attribute-to-entitlement rules and finds places where they converge—where the same attribute combinations consistently predict the same entitlements. When it finds this pattern, it groups those entitlements into a candidate role. The attribute combinations that produced the grouping become the role’s driving factors.

For example, a candidate role might appear because employees in the Finance department in the Western region almost always have the same five entitlements. The system doesn’t name this role. Instead, it presents the entitlement set, the driving factors, and confidence scores for a role engineer to review, refine, and name before publishing.

Every discovered role comes with a built-in justification: the attribute combination that produced it. If an auditor asks, “Why does this role contain these entitlements?” you can point directly to the observed workforce pattern that created the role.

Roles in access modeling have one of three states indicating their readiness for production use:

In a typical scenario, an administrator or authorized end user runs a role mining job as part of the analytics pipeline in the Advanced Identity Cloud end-user UI. During a role mining analytics run, Identity Governance discovers candidates for new roles and displays them on the Access Modeling page with confidence scores and user access patterns. Administrators and authorized users can review these roles, make edits to entitlements and access patterns, and rerun the role mining analytics until the correct mix of entitlements meets your threshold objectives for given rules. If the threshold objectives require adjustments, administrators can make the changes in the Advanced Identity Cloud admin console. Learn more in Configure access modeling thresholds.