Role Mining: Analyze Existing Group Memberships
Role discovery
Use existing group memberships to find a starting group-to-role fit, then review and refine it in the development role model.
Role mining in Tools4ever NIM compares existing target-system group memberships with roles in a development model. It proposes group-to-role assignments and shows the membership additions and removals that the proposed fit would require. Use it when target groups already contain members and you want to build a role model around that existing access.
Example: compare the proposed membership changesDirect link to Example: compare the proposed membership changes
Suppose an existing target group contains Alice, Ben, and Cara. The following illustrative role fits produce different membership changes:
| Proposed role fit | People selected by the roles | Add | Remove | Distance |
|---|---|---|---|---|
| Finance | Alice, Ben, and Dana | Dana | Cara | 2 |
| Finance and Contractors | Alice, Ben, Cara, and Dana | Dana | None | 1 |
The second fit has a lower Distance, but it still gives Dana access that she does not currently have. Review whether that access is appropriate before accepting the proposal. A Distance of 0 means no membership changes for the compared population; it does not establish that the current access is correct.
Mine a role modelDirect link to Mine a role model
Choose what to analyzeDirect link to Choose what to analyze
Go to Output > Roles > Role Mining and add or edit a miner. Select the target system and its user-to-group relationship. Optionally choose a group-selection filter to limit the groups considered.
Compare groups to rolesDirect link to Compare groups to roles
On Groups, select the groups to analyze and select Mine. Review each group's Distance—the number of membership adds and removals required if the proposed fit is executed. A distance of 0 is a perfect fit.
Refine before committingDirect link to Refine before committing
Review the proposed roles for each group, adjust included roles as needed, then select Apply and Save to write the result to the development role model.
Saving a mining result updates the development role model. Review the proposed access, follow the role-model activation process, and evaluate the relevant job before executing membership changes. Mining, saving, activating, and running a job are separate steps.
Key measuresDirect link to Key measures
| Measure | Meaning |
|---|---|
| Distance | Total predicted membership adds and removals; lower is better. |
| Matches | Members already aligned with the proposed role fit. |
| Add / Remove | Membership changes the active model would make. |
| Delta Roles | Difference between current role associations and the proposed result. |
Select Clear to remove pending results for selected groups or Restore to reload their existing development-model associations.
Continue building the role modelDirect link to Continue building the role model
- Use role generators to derive roles from source data.
- Use the Role mining visual to inspect the selected miner's progress and role clusters.
- Inspect roles before moving changes into operation.