01
03 · Govern · From access patterns to roles
Roles & role mining
Find useful roles without months of workshops.
Several mining methods find access patterns that repeat. RapidValue merges overlapping proposals and describes each one in business terms an owner can judge. A role can only be formalised once it has an owner.
What changes
What you get
02
Overlapping proposals merged into one
03
See who a role covers before it goes live
04
An owner for every role, until it retires
How it works
It works in three steps
Each step records its reason, and the next step uses it.
Propose
Read patterns from access people actually hold.
Shape
Compare coverage, exceptions and business meaning.
Formalise
Require an owner and lifecycle before the role governs access.
What a proposal is
Every proposal comes with the evidence behind it
A run reads the access people already hold and applies eight grouping rules, each with a name. There is no model that learns. The answer to “why is this a role?” is one sentence: this group is department Finance and employees, found by the organisational-unit rule.
What you see for each proposal
- Outsiders who hold it and members who lack it are listed only
- Coverage before and after, with one definition, and never lower after
- A “mostly already governed” label for access that a role or policy already explains
- Roles you already formalised are never proposed again
A new role from a groupPeople who share an organisational unit, a job function, a context or an identity type and hold the same access.
Extend: a role you haveMembers of an existing role who have all picked up the same extra permission.
AutomatePeople who hold nearly everything in a role without holding it. You get one access policy proposed, after you confirm how many other people it would match.
Evidence per entitlementHow many of the group hold it, how many do not, and how many outside the group hold it.
A recommendationInclude from 70% coverage and 50% exclusivity, consider between 50% and 70%, skip below. You can change the thresholds in the settings.
A confidence figureA printed formula of coverage, exclusivity and group size. It ranks proposals against each other and does not claim a probability.
Before it becomes a role
A named owner and a reviewer chain come first
Formalising a proposal means submitting it for approval. It does not publish anything.
1
An owner is required
The server refuses a role without an owner: a person, a group, or a context owner that follows the organisation chart. A business role type is required too.
2
The chain comes from the role type
Reviewers come from the role type, a default you have set or a single manager step. Mining sets no chain of its own.
3
In approval, with the policy off
The role starts in approval and its access policy is created disabled. When the chain completes, the role is active and the policy is on. A permission rejected in review is removed first.
4
Mining revokes nothing
Formalising adds structure and takes nobody’s access away. What to do about people outside the group is a separate decision.
Over time
Run it, accept what holds, retire what is done
01
Runs, and a daily sweep
Start a run for the whole organisation, one scope or one connected system. A background sweep keeps the ungoverned-access analysis fresh, daily by default, and does not replace proposals you are reviewing.
02
One at a time or in bulk
New-role proposals can be accepted in bulk above a confidence level, and each still passes the owner check. Extend and Automate proposals are accepted one at a time.
03
Retire with a sunset date
New requests stop and holders keep their access for a grace period, 30 days by default. Then the access is removed through normal provisioning, with an audit entry for each grant.
04
Retired by a review
When reviewers reject a role in its certification, the role can be retired the same way, so it does not outlive the project that asked for it.
It proposes candidates from the access seen today, in the systems you have connected and reconciled. A group that shares access for a bad reason still looks like a role, which is what the reviewers are for.
What we stand behind
Role decisions can stay in place for years, so people take them at their own pace.
Included
Included in every price
There is no module to buy for this. The price depends only on how many identities you govern.