The problem
Role models that do not match reality
Roles are the backbone of an IGA solution: they determine what new employees automatically get access to, what can be requested, and what recertification has to assess. If the roles are wrong, everything else goes wrong with them – onboarding grants too little or too much, and approvers sign off on roles they do not understand.
Most failed role models fall into one of two ditches. Either the model is designed in such detail that there end up being more roles than employees (role explosion), and maintenance eats the gains. Or the roles become so broad that everyone gets more than they need, and the model becomes a threat to the principle of least privilege instead of a guarantee of it.
Two approaches
Top-down and bottom-up – each with a strength, each with a blind spot
Top-down: the business draws
Roles are derived from the organisation and job functions: what should a caseworker, a salesperson or a controller be able to do? The model becomes understandable and anchored in the business – but the work is slow, and roles drawn on a whiteboard often miss the entitlements the work actually requires.
Bottom-up: the data speaks (role mining)
Entitlement data is analysed for patterns: which access rights appear together, and which groups of employees resemble each other? Candidate roles emerge in weeks instead of months – but mining raw data also cements the mistakes of the past. Accumulated and outdated entitlements become roles if nobody asks questions.
The hybrid
Data proposes, the business decides
The approach that works in practice combines the two: role mining delivers candidate roles from the actual data, and the business validates them against reality. The role owner sees a proposal built on what the department's employees already hold, and only has to assess the deviations: does this entitlement really belong in the role, or is it inherited from another era?
The hybrid thereby solves both ditches' problems. The bottom-up analysis ensures the roles match the work actually being done, and the top-down validation ensures old sins do not gain eternal life as birthright access. The result is fewer, better justified roles – and role owners who understand what they own.
The process
Hybrid role mining in four steps
- Clean the data foundation
Remove orphaned accounts, unused entitlements and ownerless direct assignments before the analysis runs. Mining dirty data produces dirty roles.
- Mine candidate roles
Analyse entitlement patterns per department, job function or location, and let the algorithm propose candidate roles with coverage rates and deviations.
- Validate with the business
Role owners review the candidates: naming, content and boundaries. Entitlements nobody can justify go out – not into the role.
- Pilot, roll out and maintain
Start with one department, measure the effect on requests and recertification, and adjust. A role model is a process that must be owned – and roles need an owner and an expiry control from day one.
IVIP
Where does IVIP come into the picture?
Role mining is only as good as the data it runs on – and that is where an Identity Visibility and Intelligence Platform makes the difference. An IVIP gathers entitlement data from AD, Entra ID and the business applications into one consolidated picture, delivering the very raw material for the analysis. The clean-up in step one is the platform's home turf: orphaned accounts, unused access and hidden assignments are exactly what its analytics find.
Several IVIP platforms can also propose candidate roles themselves from the patterns in the data – and show how much of a department's entitlements a proposed role covers. That makes them a natural engine room for the hybrid approach, whether the role model is destined for an upcoming IGA solution or for tightening an existing one.
And the work does not stop at go-live: role models drift. Employees change function, systems are added, and exceptions pile up. A continuously updated overview shows when reality has outgrown the model – so the roles are adjusted before the deviation becomes a risk.
Should your role model be built on data?
We help clean the data foundation, run the role mining and anchor the model with the business – as part of an IGA engagement or as a standalone task.
