Patent Publication Number: US-8978114-B1

Title: Recommendation engine for unified identity management across internal and shared computing applications

Description:
CLAIM OF PRIORITY TO PROVISIONAL APPLICATION 
     This application claims benefit of priority of U.S. Provisional Application Ser. No. 61/671,776 entitled “Methods and Apparatus for Identity Management” filed Jul. 15, 2012, the content of which is incorporated by reference herein in its entirety. 
     This application claims benefit of priority as a continuation-in-part of U.S. patent application Ser. No. 13/656,340, filed Oct. 19, 2012 and entitled “Methods and Apparatus for a Unified Identity Management Interface Across Internal and Shared Computing Applications,” the content of which is incorporated by reference herein in its entirety. 
     This application claims benefit of priority as a continuation-in-part of Unite States patent application Ser. No. 13/712,755, filed Dec. 12, 2012 and entitled “Graphical User Interface for Unified Identity Management Across Internal and Shared Computing Applications,” the content of which is incorporated by reference herein in its entirety. 
    
    
     BACKGROUND 
     Description of the Related Art 
     As the reach and accessibility of computer networks such as the Internet and corporate networks increase, the amount of information accessible via such networks grows exponentially, creating a concomitant tendency toward increasing ability of systems on those networks to perform a richer and more varied array of functions. For example, as commercial enterprises increasingly embrace a digital workplace, a suite of computer-based systems is being deployed for the management of functions ranging from the delivery of information to the execution of transactions and operation of machinery. 
     The increase in the number of functions performed by computing machines operating over networks increases the need to provide advanced interfaces and tools for managing access to those computing machines and the networks that connect them. Identity management is the management of individual identities, their authentication, authorization, and privileges/permissions within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime, and repetitive tasks. 
     The problems of identity management are compounded by the scale of enterprises, the complexity and variety of resources provided, and the heterogeneity of resource types and environments. Interfaces and tools in the identity management space have yet to fully address the problems created by an increasingly global, increasingly networked work environment with resources deployed on varying networks in varying locations and supporting diverse casts of users. 
     SUMMARY 
     A recommendation engine for identity management is disclosed. A data store including an identity management access database is provided. Suggested access entitlement operations for potential identities of a listing of identities on which to perform access entitlement operations are generated. Suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations are offered through a user interface. In some embodiments, the generating suggested access entitlement operations includes analyzing a requesting user and one or more identities with connection to the requesting user to identify the potential identities of the listing of identities on which to perform access entitlement operations, and based at least in part on the patterns of access entitlement in the identity management access database, selecting the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  illustrates a system that may implement identity management, according to some embodiments. 
         FIG. 2A  depicts a module that may implement identity management, according to some embodiments. 
         FIG. 2B  illustrates a recommendation module according to some embodiments. 
         FIG. 3A  is a flowchart of operations used in providing recommendations of identity management operations, according to some embodiments. 
         FIG. 3B  is a flowchart of operations used in performing identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 3C  is a flowchart of operations used in suggesting an access entitlement operation, according to some embodiments. 
         FIG. 3D  is a flowchart of operations used in suggesting a user for an access entitlement operation, according to some embodiments. 
         FIG. 3E  is a flowchart of operations used in suggesting a “quick action” access entitlement operation, according to some embodiments. 
         FIG. 4A  is a flowchart of operations used in providing a data store including an identity management access database, according to some embodiments. 
         FIG. 4B  is a flowchart of operations used in generating suggested access entitlement operations, according to some embodiments. 
         FIG. 4C  is a flowchart of operations used in offering through a user interface the suggested access entitlement, according to some embodiments. 
         FIG. 4D  is a flowchart of operations used in offering through a user interface the suggested access entitlement, according to some embodiments. 
         FIG. 4E  is a flowchart of operations used in offering through a user interface the suggested access entitlement, according to some embodiments. 
         FIG. 5A  is a flowchart of operations used in performing identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 5B  is a flowchart of operations used in performing monitoring functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 6  is a flowchart of operations used in performing diagnostic functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 7  is a flowchart of operations used in performing diagnostic functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 8  is a flowchart of operations used in performing predictive diagnostic functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 9  is a flowchart of operations used in performing predictive functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 10  is a flowchart of operations used in performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 11  is a graphical user interface for performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 12  is a graphical user interface for performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 13  is a graphical user interface for performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 14  is a graphical user interface for displaying data in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 15  is a graphical user interface for requesting an access entitlement in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 16  is a graphical user interface for requesting an access entitlement in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 17  is a graphical user interface for approving an access entitlement in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 18  is a graphical user interface for managing access entitlements in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 19  is a graphical user interface for managing access entitlements in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. 
         FIG. 20  illustrates an example computer system that may be used in embodiments. 
     
    
    
     While the invention is described herein by way of example for several embodiments and illustrative drawings, those skilled in the art will recognize that the invention is not limited to the embodiments or drawings described. It should be understood, that the drawings and detailed description thereto are not intended to limit the invention to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the present invention. The headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description. As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). Similarly, the words “include”, “including”, and “includes” mean including, but not limited to. 
     DETAILED DESCRIPTION OF EMBODIMENTS 
     Some embodiments address the problem of a user interface for managing identities and corresponding access privileges across multiple platforms that include both external (for example, cloud-based) resources and internal (for example, on-premise) resources. In some embodiments, a single user interface for a user of an identity management module is presented. The single user interface includes options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. The user interface is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine. 
     Some embodiments of the graphical user interface provide a unified management interface across internal and shared computing applications, thereby allowing a user to create and manage accounts through a single interface for both the on-premise applications and the cloud-based applications used by his or her company without ever having to know or being informed of whether a particular option is executed on the on-premise applications or the cloud-based applications. In some embodiments, one or more processors perform, responsive to receiving a plurality or set of access management requests at an identity management interface, transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. 
     Introduction to Computing Terminology 
     In the following detailed description, numerous specific details are set forth to provide a thorough understanding of claimed subject matter. However, it will be understood by those skilled in the art that claimed subject matter may be practiced without these specific details. In other instances, methods, apparatuses or systems that would be known by one of ordinary skill have not been described in detail so as not to obscure claimed subject matter. 
     Some portions of the detailed description which follow are presented in terms of algorithms or symbolic representations of operations on binary digital signals stored within a memory of a specific apparatus or special purpose computing device or platform. In the context of this particular specification, the term specific apparatus or the like includes a general purpose computer once it is programmed to perform particular functions pursuant to instructions from program software. Algorithmic descriptions or symbolic representations are examples of techniques used by those of ordinary skill in the signal processing or related arts to convey the substance of their work to others skilled in the art. An algorithm is here, and is generally, considered to be a self-consistent sequence of operations or similar signal processing leading to a desired result. In this context, operations or processing involve physical manipulation of physical quantities. Typically, although not necessarily, such quantities may take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared or otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to such signals as bits, data, values, elements, symbols, characters, terms, numbers, numerals or the like. It should be understood, however, that all of these or similar terms are to be associated with appropriate physical quantities and are merely convenient labels. 
     Unless specifically stated otherwise, as apparent from the following discussion, it is appreciated that throughout this specification discussions utilizing terms such as “processing,” “computing,” “calculating,” “determining” or the like refer to actions or processes of a specific apparatus, such as a special purpose computer or a similar special purpose electronic computing device. In the context of this specification, therefore, a special purpose computer or a similar special purpose electronic computing device is capable of manipulating or transforming signals, typically represented as physical electronic or magnetic quantities within memories, registers, or other information storage devices, transmission devices, or display devices of the special purpose computer or similar special purpose electronic computing device. 
     While some processes or operations described herein are described as being performed by a particular module or modules, one of skill in the art will readily discern in light of having read the present disclosure that such operations or process may be performed by other modules or other computing systems without departing from the scope and intent of the present disclosure. Likewise, while some process are presented as a series of operations and are explained in a particular order, one of skill in the art will readily discern in light of having read the present disclosure that such operations or processes may be performed in an alternative order or combination without departing from the scope and intent of the present disclosure. Embodiments will combine, omit, and substitute modules and the operations that they perform or execute without departing from the scope and intent of the present disclosure. In the discussion contained herein, embodiments are described as performing operations or procedures, which may be taken to mean both performing an operation or procedure directly or supporting that operation or procedure through the processing or preparation of data for that operation or procedure. 
     Introduction to Suggesting Access Entitlement Operations Based at Least in Part Upon the Expected Access Entitlements 
     Various embodiments of methods and apparatus for suggesting access entitlement operations are disclosed. In some embodiments, a data store including an identity management access database is provided. In some embodiments, the providing a data store includes recording a listing of identities. For each identity of the listing of identities, a set of peer and supervisory relationships between the identity and other identities of the listing of identities is recorded. For each identity of the listing of identities, previously requested access entitlement operations are recorded. 
     Suggested access entitlement operations for potential identities of the listing of identities on which to perform access entitlement operations are generated. In some embodiments, the generating suggested access entitlement operations includes analyzing a requesting user and one or more identities with connection to the requesting user to identify the potential identities of the listing of identities on which to perform access entitlement operations. In some embodiments, the generating suggested access entitlement operations includes analyzing the one or more identities with connection to the requesting user to identify patterns of access entitlement in the identity management access database. In some embodiments, the generating suggested access entitlement operations includes, based at least in part on the patterns of access entitlement in the identity management access database, selecting the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations. 
     In some embodiments, suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations are offered through a user interface. In some embodiments, the selecting the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations further includes calculating a ratio of a number of identities with connection to the requesting user to a number of identities with connection to the requesting user having a particular access entitlement. 
     In some embodiments, the offering through a user interface the suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations further includes calculating for each of the one or more identities with connection to the requesting user a likelihood of access entitlement operation request, ranking the one or more identities with connection to the requesting user according to the respective likelihood of access entitlement operation request, and providing a listing of the one or more identities with connection to the requesting user in order of the ranking. 
     In some embodiments, the offering through a user interface the suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations further includes calculating for each of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations a likelihood of access entitlement operation request, ranking the one or more identities with connection to the requesting user according to the respective likelihood of access entitlement operation request, and providing a listing of the one or more identities with connection to the requesting user in order of the ranking. 
     In some embodiments, the offering through a user interface the suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations further includes calculating for each of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations a likelihood of access entitlement operation request, ranking the one or more identities with connection to the requesting user according to the respective likelihood of access entitlement operation request, and providing a listing of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations in order of the ranking. 
     In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations for performance on peers of the requesting user based on recent changes to access entitlements held by other peers of the requesting user, and wherein said peers of the requesting user have similar manager and title as the requesting user. In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations for performance on peers of the requesting user based on access entitlements held by other peers of the requesting user. 
     In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations for performance on peers of the requesting user based on recent changes to access entitlements held by other peers of the requesting user, and said peers of the requesting user have similar location to the requesting user. In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations on peers of the requesting user. In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations on direct reports of the requesting user. In some embodiments, the generating suggested access entitlement operations further includes ranking identities for suggestion of access entitlement operations based at least in part upon a date of identity creation or a date of most recent modification. 
     In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations for performance on peers of the requesting user based on recent changes to access entitlements held by other peers of the requesting user, and the peers of the requesting user have similar location to the requesting user. In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations on peers of the requesting user. In some embodiments, the generating suggested access entitlement operations further includes suggesting access entitlement operations on direct reports of the requesting user. In some embodiments, the generating suggested access entitlement operations further includes ranking identities for suggestion of access entitlement operations based at least in part upon a date of identity creation or a date of most recent modification. In some embodiments, the generating suggested access entitlement operations further includes ranking persons and separately ranking entitlements. 
     Some embodiments may include a means for suggesting access entitlement operations. For example, a recommendation module (also called a recommendation engine or prediction engine, and one of skill in the art will readily understand in view of having read the present disclosure such terms may be used interchangeably herein) may interact with a data store including an identity management access database, generate suggested access entitlement operations for potential identities of the listing of identities on which to perform access entitlement operations, and interact with a user interface to offer through the user interface the suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations, as described herein. The recommendation module may in some embodiments be implemented by a non-transitory, computer-readable storage medium and one or more processors (e.g., CPUs and/or GPUs) of a computing apparatus. The computer-readable storage medium may store program instructions executable by the one or more processors to cause the computing apparatus to interact with a data store including an identity management access database, generate suggested access entitlement operations for potential identities of the listing of identities on which to perform access entitlement operations, and interact with a user interface to offer through the user interface the suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations, as described herein. Other embodiments of the recommendation module may be at least partially implemented by hardware circuitry and/or firmware stored, for example, in a non-volatile memory. 
     Various embodiments of methods and apparatus for suggesting access entitlement operations based at least in part upon the expected access entitlements are disclosed. In some embodiments, an identity management access database is exposed to a prediction engine. Expected access entitlements of an identity are predicted in response to discovery of patterns in the identity management access database. Access entitlement operations are suggested based at least in part upon the expected access entitlements. 
     In some embodiments, the suggesting access entitlement operations based upon the expected access entitlements further comprises modifying a graphical user interface to highlight suggested access entitlement operations based at least in part upon the expected access entitlements. In some embodiments, the suggesting access entitlement operations based upon the expected access entitlements further includes suggesting modifications to an existing role based at least in part upon the expected access entitlements. In some embodiments, the suggesting access entitlement operations based upon the expected access entitlements further includes suggesting modifications to an existing identity based at least in part upon the expected access entitlements. 
     In some embodiments, the suggesting access entitlement operations based upon the expected access entitlements further includes auditing existing identities to detect anomalies based at least in part upon the expected access entitlements. In some embodiments, the suggesting access entitlement operations based upon the expected access entitlements further comprises suggesting access entitlement operations based upon changes to usage patterns in the access entitlements of existing users. In some embodiments, the exposing the identity management access database to a prediction engine further comprises facilitating prediction of access entitlements based at least in part on runtime changes by exposing the identity management access database to a runtime-learning neural networks based prediction engine. 
     Some embodiments may include a means for suggesting access entitlement operations based at least in part upon the expected access entitlements. For example, an identity management module may expose an identity management access database to a prediction engine, expected access entitlements of an identity are predicted in response to discovery of patterns in the identity management access database and access entitlement operations are suggested based at least in part upon the expected access entitlements, as described herein. 
     The identity management module may in some embodiments be implemented by a non-transitory, computer-readable storage medium and one or more processors (e.g., CPUs and/or GPUs) of a computing apparatus. The computer-readable storage medium may store program instructions executable by the one or more processors to cause the computing apparatus to perform exposing an identity management access database to a prediction engine, predicting expected access entitlements of an identity in response to discovery of patterns in the identity management access database and suggesting access entitlement operations are suggested based at least in part upon the expected access entitlements, as described herein. Other embodiments of the identity management module may be at least partially implemented by hardware circuitry and/or firmware stored, for example, in a non-volatile memory. 
     As used herein, the term identity can mean any of a user, a resource, a role or a privilege, without departing from the scope and intent of the present application. 
     Introduction to Performing Adaptive User Interface Functions in Identity Management 
     Various embodiments of methods and apparatus for performing adaptive user interface functions in identity management are disclosed. A user interface is presented to a user of an identity management module. In some embodiments the user interface is a single user interface including options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. In some embodiments, the user interface is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine. 
     In some embodiments, a prediction engine is a system for generating a prediction of future activity from a dataset. Some embodiments build a model from a user&#39;s past behavior (e.g., options selected) as well as similar decisions made by other users, then use that model to predict items that the user may have an interest in. Prediction engines are also sometimes referred to as recommender systems. One approach to the design of prediction engines that has seen wide use is collaborative filtering. Collaborative filtering methods are based on collecting and analyzing a large amount of information on users&#39; behaviors, activities or preferences and predicting what users will like based on their similarity to other users. A key advantage of the collaborative filtering approach is that it does not rely on machine analyzable content and therefore it is capable of accurately recommending complex items without requiring an “understanding” of the item itself. 
     Another common approach when designing prediction engines is content-based filtering. Content-based filtering methods are based on information about and characteristics of the items that are going to be recommended. In other words, these algorithms try to recommend items that are similar to those that a user selected in the past (or is examining in the present). In particular, various candidate items are compared with items previously rated by the user and the best-matching items are recommended. In some embodiments, these methods use an item profile (i.e., a set of discrete attributes and features) characterizing the item within the system. The system creates a content-based profile of users based on a weighted vector of item features. The weights denote the importance of each feature to the user and can be computed from individually rated content vectors using a variety of techniques. Simple approaches use the average values of the rated item vector while other sophisticated methods use machine learning techniques such as Bayesian classifiers, cluster analysis, decision trees, and artificial neural networks in order to estimate the probability that the user is going to select the item. Direct feedback from a user, usually in the form of a selection, can be used to assign higher or lower weights on the importance of certain attributes (using Rocchio classification or other similar techniques). 
     Some embodiments apply a hybrid approach, combining collaborative filtering and content-based filtering. Hybrid approaches can be implemented in several ways: by making content-based and collaborative-based predictions separately and then combining them; by adding content-based capabilities to a collaborative-based approach (and vice versa); or by unifying the approaches into one model. These embodiments can also be used to overcome some of the common problems in recommender systems such as cold start and the sparsity problem. 
     Example prediction engine algorithms include k-nearest neighbor, Pearson correlation and Rocchio relevance filtering. The k-NN algorithm is a method for classifying objects based on the properties of its closest neighbors in the feature space. In k-NN, an object is classified through a majority vote of its neighbors, with the object being assigned to the class most common amongst its k nearest neighbors (k is a positive integer, typically small). If k=1, then the object is simply assigned to the class of its nearest neighbor. The Pearson correlation is a measure of the correlation (linear dependence) between two variables X and Y, giving a value between +1 and −1 inclusive. In a social network, such as a list of employees with defined relationships in an identity management system, a particular user&#39;s neighborhood with similar taste or interest can be found by calculating the Pearson correlation coefficient. By collecting the preference data of top-N nearest neighbors of a particular user (weighted by similarity), the user&#39;s preference can be predicted. Rocchio relevance filtering makes use of the vector space model and is based on the assumption that most users have a general conception of which items should be denoted as relevant or non-relevant. User feedback (e.g. selections) is used to refine a search query by emphasizing or deemphasizing certain terms. Through feedback, the user&#39;s search query is revised to include an arbitrary percentage of relevant and non-relevant terms as a means of increasing the search engine&#39;s recall, and possibly the precision as well. The number of relevant and non-relevant terms allowed to enter a query is dictated by a series of weights in the central equation. 
     In some embodiments, the prediction engine is a learning based prediction engine. Learning based prediction engines take as input empirical data, such as selections by users of entitlement options, and (a) identify (i.e., quantify) complex relationships thought to be features of the underlying mechanism that generated the data, and (b) employ these identified patterns to make predictions based on new data. Data can be seen as instances of the possible relations between observed variables; the algorithm acts as a machine learner which studies a portion of the observed data (called examples of the data or training data) to capture characteristics of interest of the data&#39;s unknown underlying probability distribution, and employs the knowledge it has learned to make intelligent decisions based on new input data. 
     Some embodiments use a supervised-learning based prediction engine that generates a function that maps inputs to desired outputs (also called labels, because they are often provided by human experts labeling the training examples). For example, some embodiments approximate a function mapping a vector into classes by looking at input-output examples of the function. Some embodiments use an usupervised-learning based prediction engine that finds hidden structure in unlabeled data (e.g., using clustering, k-means, mixture models, or hierarchical clustering). Some embodiments use neural network models, such as the self-organizing map (SOM) and adaptive resonance theory (ART). The self-organizing map is a topographic organization in which nearby locations in the map represent inputs with similar properties. The adaptive resonance theory model allows the number of clusters to vary with problem size and lets the user control the degree of similarity between members of the same clusters by means of a user-defined constant called the vigilance parameter. Adaptive resonance theory networks are also used for many pattern recognition tasks, such as automatic target recognition and seismic signal processing. 
     In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations further includes adaptively adjusting the user interface based at least in part upon user identity and past behavior. In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations further comprises adaptively adjusting the user interface such that, when the user clicks on suggestions, in the access request interface, the recommendation engine determines, based on the end user&#39;s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user (the requester) may want to request access. Some embodiments use a semi-supervised-learning based prediction engine that combines both labeled and unlabeled examples to generate an appropriate function or classifier. Some embodiments use a reinforcement based-learning based prediction engine that learns how to act given an observation of the world. In some embodiments, every action has some impact in the environment, and the environment provides feedback in the form of rewards that guide the learning algorithm. Some embodiments use a transduction based-learning based prediction engine. 
     In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations further includes the presenting the single user interface including the options for transmitting the access management instruction to the customer internal application via the on-premise proxy, and the transmitting the another access management instruction to the shared computing system application via the multi-customer gateway on the shared computing system further includes presenting the user interface in a platform-agnostic fashion such that user controls do not inform a user of the single user interface as to whether a particular option invokes transmission to a shared computing system or a customer internal application. 
     In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further includes adaptively adjusting the user interface to highlight suggested access entitlement operations based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. 
     In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further includes presenting a next selected operation based on patterns in an identity management access database discerned by a learning-based prediction engine. In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further includes presenting a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface. 
     Some embodiments may include a means for adaptive user interface functions in identity management. For example, an identity management module may present a user interface, as described herein. In some embodiments the user interface presented by the identity management module is a single user interface including options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. In some embodiments, the user interface presented by the identity management module is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine. 
     The non-uniform identity management module may in some embodiments be implemented by a non-transitory, computer-readable storage medium and one or more processors (e.g., CPUs and/or GPUs) of a computing apparatus. The computer-readable storage medium may store program instructions executable by the one or more processors to cause the computing apparatus to perform presenting a user interface, as described herein. In some embodiments the user interface is a single user interface including options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. In some embodiments, the user interface is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine. Other embodiments of the identity management module may be at least partially implemented by hardware circuitry and/or firmware stored, for example, in a non-volatile memory. 
     Introduction to Integrated Interface for a Unified Management Interface Across Internal and Shared Computing Applications 
     Various embodiments of methods and apparatus for a unified management interface across internal and shared computing applications are disclosed. In some embodiments, one or more processors perform, responsive to receiving a plurality of access management requests at an identity management interface, transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. 
     In some embodiments, the transmitting the access management instruction to the customer internal application further includes transmitting the access management instruction from an identity management module to the on-premise proxy. The transmitting the another access management instruction to the shared computing system application further includes transmitting the access management instruction from the identity management module to the multi-customer gateway. The identity management module is located external to a firewall. The on-premise proxy and the customer internal application are located internal to the firewall. The shared computing system application and the multi-customer gateway on the shared computing system are located external to the firewall. 
     In some embodiments, the shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction. 
     In some embodiments, the shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction. A present problem is diagnosed based at least in part on a failure of fulfillment of the access management instruction or the another access management instruction. A correction to the problem is suggested. 
     In some embodiments, the shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction as well as patterns of access management instructions and fulfillments. A present problem is diagnosed based on a pattern of failures of access management instruction and fulfillments. A correction to the problem is suggested. 
     In some embodiments, the shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction as well as patterns of access management instructions and fulfillments. A future problem is predicted based at least in part on a pattern of failures of access management instruction and fulfillments. A correction to the problem is suggested. In some embodiments, the diagnosing, predicting or suggesting further includes diagnosing, predicting or suggesting based at least in part on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. 
     Some embodiments may include a means for unified management interface across internal and shared computing applications. For example, an identity management module may, responsive to receiving a plurality of access management requests at an identity management interface, perform transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system, as described herein. 
     The identity management module may in some embodiments be implemented by a non-transitory, computer-readable storage medium and one or more processors (e.g., CPUs and/or GPUs) of a computing apparatus. The computer-readable storage medium may store program instructions executable by the one or more processors to cause the computing apparatus to perform, responsive to receiving a plurality of access management requests at an identity management interface, transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system, as described herein. Other embodiments of the identity management module may be at least partially implemented by hardware circuitry and/or firmware stored, for example, in a non-volatile memory. 
     Example Implementations 
       FIG. 1  illustrates a system that may implement identity management, including a recommendation engine for identity management, according to some embodiments. Identity management is the management of user individual identities, their authentication, authorization, and privileges/permissions within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime, and repetitive tasks. A typical problem of identity management is creating the accounts on various systems for a new employee or adjusting the access privileges of those accounts as the role or roles of the employee change. 
     In one embodiment, an identity management ecosystem  100  includes (customer internal) on-premise applications  130   a - 130   n  and shared computing system (cloud) applications  140   a - 140   n  that are managed that are managed by an identity management module  120 . Note that, as used herein, ‘n’ represents a flexibly variable quantity of elements, and the presence of differently numbered devices bearing the same reference letter (e.g.,  102   a  and  100   a ), does not necessarily indicate a correspondence or interaction between differently numbered devices bearing the same reference letter. Further, the recurrence of ‘n’ as an alphabetical designator does not indicate that multiple flexibly variable quantities of devices are equal. Nor does the designation of a single member of such a plurality as ‘n’ indicate that it necessarily corresponds to an ‘nth’ member of a different plurality, though they may correspond. This convention is employed in order to reduce confusion in the drawings. An example of a typical identity management problem might be the addition of a new doctor in a hospital. Such a doctor might need access to customer internal systems represented by on-premise applications  130   a - 130   n.    
     Examples of such internal systems might be building security (e.g., the activation of an identification badge to open doors in the hospital), payroll and benefits, and shift scheduling. At the same time, the doctor might also require access to off-premise shared computing system (cloud) applications  140   a - 140   n  such as insurance billing systems, pharmacy prescribing systems, and centralized medical records. Identity management module  120  may support user management by a help/service desk, as in creation, deletion, modification of user identity data by a staffed desk to provide the hypothetical doctor with required access. Alternatively or additionally, identity management module  120  may support user self service, as in a user being able to modify one&#39;s own mutable or correctable data—e.g. postal address, telephone number, and more importantly and frequently, one&#39;s own credentials. Credentials are the, typically, secret piece of information that allows a user to identify himself or herself to the identity management system. 
     Identity management module  120  receives a plurality of access management requests at an identity management interface. These access management requests include creation, deletion, modification of user identity data and granting or removal of privileges to various systems. In some embodiments, some access management requests are role based, which is to say that the access privileges associated with a particular user are based on a role associated with the user. 
     For example, identity management module  120  may receive an access management request at an identity management interface to create a new user who is identified in the ‘doctor’ role, with access privileges, such as prescribing, medical records, scheduling, billing, physical building access, and benefits assigned to that role as described above. Alternatively, identity management module  120  may receive an access management request at an identity management interface to create a new user who is identified in the ‘nurse’ role, with access privileges, such as medical records, scheduling, physical building access, and benefits assigned to the role, but prescribing and billing withheld. Other examples of access management requests supported by embodiments include changing the role or roles of a user, making individual modifications outside those typically assigned with to a role, or updating a role to apply updates to all users having that role. 
     In some embodiments, some access management requests facilitate role-based delegated user administration, which involves, as an example, a supervisor of an employee being able to modify certain attributes of an employee&#39;s user data. In some embodiments, delegation allows for scaling of an identity management solution in that local administrators with access to identity management module  120  or supervisors with access to identity management module  120  are able to perform permissible modifications without requiring authorization from a global administrator. Roles-based aspects allow for the supervisor to be a role in such embodiments, as opposed to a specific person. Role-based access mechanisms also allow for implementation of privacy controls around user attribute data. In some embodiments, identity management module  120  may handle through access management requests provisioning resources, as in the assignment of a desk or a phone to a new employee in an office. 
     In response to receiving the plurality of access management requests at the identity management interface, identity management module  120  transmits access management instructions across customer firewall  150  using connector  110   b  and connectors  170   a - 170   n  to customer internal applications  130   a - 130   n  via an on-premise proxy  160 . Identity management module  120  transmits other access management instructions to a shared computing system  105  (e.g., a cloud) and shared computing system applications  140   a - 140   n  via a multi-customer shared computing system gateway  180  on the shared computing system  105  using connectors  190   a - 190   n  and connector  110   a.    
     As described below with reference to  FIGS. 11-18 , a user interface is presented to a user of identity management module  120 . In some embodiments the user interface is a single user interface including options for transmitting access management instructions to (customer internal) on-premise applications  130   a - 130   n  via on-premise proxy  160 , and transmitting other access management instructions to a shared computing system (cloud) applications  140   a - 140   n  via multi-customer shared computing system gateway  180  on the shared computing system  105 . In some embodiments, the user interface is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine, recommendation engine, or recommendation module, as described herein. 
     In some embodiments, an identity management access database is exposed to a prediction engine by identity management module  120 . Expected access entitlements of an identity are predicted by identity management module  120  in response to discovery of patterns in the identity management access database. Access entitlement operations are suggested by identity management module  120  based at least in part upon the expected access entitlements. In some embodiments, identity management module  120  performs providing a data store including an identity management access database, generating suggested access entitlement operations for potential identities of the listing of identities on which to perform access entitlement operations, and offering through a user interface the suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations, as described herein. Example operations of a prediction engine, recommendation engine, or recommendation module, as described with respect to  FIGS. 3A-4E , as well as elsewhere herein. 
     In some embodiments, identity management module  120  transmits the access management instructions to the customer internal applications (on premise applications  130   a - 130   n ) by transmitting the access management instructions from the identity management module  120  to the on premise proxy  160 , and transmits other access management instructions to the shared computing system applications  140   a - 140   n  by transmitting the access management instructions from the identity management module  120  to the multi-customer gateway (shared computing system gateway  180 ). In some embodiments, a firewall  150  separates identity management module  120  and shared computing system applications  140   a - 140   n  from on-premise applications  130   a - 130   n  such that the identity management module  120  is located external to the firewall  150 . The on-premise proxy  160  and the customer internal applications (on premise applications  130   a - 130   n ) are located internal to the firewall  150 . The shared computing system applications  140   a - 140   n  and the multi-customer gateway (shared computing system gateway  180 ) on the shared computing system (cloud  105 ) are located external to the firewall  150 . 
     In some embodiments, identity management module  120  monitors the shared computing system (cloud  105  or one or more of shared computing system applications  140   a - 140   n ) and the customer internal application (on premise applications  130   a - 130   n ) for fulfillment of access management instructions. In some embodiments, identity management module  120  diagnoses a present problem based at least in part on a failure of fulfillment of the access management instructions and suggests a correction to the problem. In some embodiments, identity management module  120  monitors the shared computing system (cloud  105  or one or more of shared computing system applications  140   a - 140   n ) and the customer internal application (on premise applications  130   a - 130   n ) for fulfillment of access management instructions as well as patterns of access management instructions and fulfillments. In some embodiments, identity management module  120  diagnoses a present problem based at least in part on a pattern of failures of access management instruction and fulfillments and suggests a correction to the problem. 
     In some embodiments, identity management module  120  monitors the shared computing system (cloud  105  or one or more of shared computing system applications  140   a - 140   n ) and the customer internal application (on premise applications  130   a - 130   n ) for fulfillment of access management instructions as well as patterns of access management instructions and fulfillments. In some embodiments, identity management module  120  predicts a future problem based at least in part on a pattern of failures of access management instruction and fulfillments and suggests a correction to the problem. In some embodiments, the predicting includes predicting based at least in part on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. 
       FIG. 2A  depicts a module that may implement identity management, according to some embodiments, which may implement one or more of the identity management techniques and tools illustrated in  FIGS. 3A-18  or variously described herein. Identity management module  220  may, for example, implement one or more of a tool for unified management interface across internal and shared computing applications, an adaptive user interface, or a tool for access entitlement operations based at least in part upon the expected access entitlements.  FIG. 19  illustrates an example computer system on which embodiments of identity management module  220  may be implemented. 
     Identity management module  220  receives as input one or more incoming messages  210 . Incoming messages may be received from user shared computing system applications across connectors by means of a shared computing system gateway or from on-premise applications across connectors by means of an on-site proxy, as described above with respect to  FIG. 1 . An example incoming message is a message indicating fulfillment of an access management instruction. 
     Identity management module  220  may receive user input  212  including access management requests. Identity management module  220  then transmits an access management instruction as an outgoing message  260  to a customer internal application via an on-premise proxy, and transmits another access management instruction to a shared computing system application as an outgoing message  260  via a multi-customer gateway on the shared computing system, according to user input  212  received via user interface  222 , which may execute on a diverse assortment of physical computing platforms that include devices ranging from mobile computing platforms (phones, tablets, laptop computers) to fixed computing platforms such as desktop computers and virtual sessions on shared computing systems. Identity management module  220  generates as output one or more data store updates  230 . Data store updates  270  may, for example, be stored to a data store  280 , such as an identity management access database stored on system memory, a disk drive, DVD, CD, etc. In response to user input  212  including access management requests received at user interface  222 , a proxy interface module  230  performs transmitting an access management instruction to a customer internal application via an on-premise proxy, and a gateway interface module performs transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. 
     User interface  222  presents a user interface to a user of an identity management module. Examples of such a user interface are illustrated below with respect to  FIGS. 11-18 . In some embodiments, the user interface is a single user interface including options for transmitting using proxy interface module  250  an access management instruction as an outgoing message  260  to a customer internal application via an on-premise proxy, and transmitting via gateway interface module  230  another access management instruction as an outgoing message  260  to a shared computing system application via a multi-customer gateway on the shared computing system. In some embodiments, user interface  222  is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine interacting with data store  280 . 
     In some embodiments, an identity management access database, such as data store  280  is exposed to a prediction engine, such as recommendation engine  240 . Expected access entitlements of an identity or role are predicted by recommendation engine  240  in response to discovery of patterns in the identity management access database, such as data store  280 . Access entitlement operations are suggested by recommendation engine  240  based at least in part upon the expected access entitlements. 
     In some embodiments, user interface  222  adaptively adjusts the user interface based at least in part upon user identity and past behavior. In some embodiments, user interface  222  adaptively adjusts the user interface such that, when the user clicks on suggestions, in the access request interface, the recommendation engine determines, based on the end user&#39;s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user (the requester) may want to request access. In some embodiments, user interface  222  presents the single user interface including the options for transmitting the access management instruction to the customer internal application via the on-premise proxy, and the transmitting the another access management instruction to the shared computing system application via the multi-customer gateway on the shared computing system in a platform-agnostic fashion such that user controls do not alert or inform a user of the single user interface as to whether a particular option invokes transmission to a shared computing system or a customer internal application. 
     In some embodiments, user interface  222  adaptively adjusts the user interface to highlight suggested access entitlement operations based on a neural networks prediction engine embodied by recommendation engine  240  accessing runtime-data from data store  280  to make predictions based on changes in usage patterns. In some embodiments, user interface  222  presents a next selected operation based on patterns in identity management access database discerned by a learning-based prediction engine. In some embodiments, user interface  222  presents a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface. 
     In some embodiments, user interface  222  performs modifying a graphical user interface to highlight suggested access entitlement operations based at least in part upon the expected access entitlements as received from recommendation engine  240 . In some embodiments, recommendation engine  240  suggests modifications to an existing role based at least in part upon the expected access entitlements. In some embodiments, recommendation engine  240  suggests modifications to an existing identity based at least in part upon the expected access entitlements. In some embodiments, recommendation engine  240  audits existing identities to detect anomalies based at least in part upon the expected access entitlements. In some embodiments, recommendation engine  240  suggests access entitlement operations based upon changes to usage patterns in the access entitlements of existing users reflected in data store  280 . In some embodiments, recommendation engine  240  predicts access entitlements based at least in part on runtime changes by exposing the identity management access database to a runtime-learning neural networks based prediction engine. 
     In some embodiments, proxy interface module  250  performs the transmitting the access management instruction as an outgoing message  260  to a customer internal application by transmitting the access management instruction from an identity management module to the on premise proxy. In some embodiments, gateway interface module  230  performs the transmitting the another access management instruction to the shared computing system application by transmitting the access management instruction as an outgoing message  260  from the identity management module  220  to the multi-customer gateway. In the identity management module is located external to a firewall of a customer, and the on-premise proxy and the customer internal application are located internal to the firewall. The shared computing system application and the multi-customer gateway on the shared computing system are located external to the customer firewall. 
     In some embodiments, recommendation engine  240  monitors the shared computing system and the customer internal application via incoming messages  210  for fulfillment of the access management instruction and the another access management instruction. In some embodiments, recommendation engine  240  monitors the shared computing system and the customer internal application for fulfillment of the access management instruction and the another access management instruction, diagnoses a present problem based at least in part on a failure of fulfillment of the access management instruction or the another access management instruction, and suggests a correction to the problem. 
     In some embodiments, recommendation engine  240  monitors the shared computing system and the customer internal application via incoming messages  210  for fulfillment of the access management instruction and the another access management instruction as well as patterns of access management instructions and fulfillments, diagnoses a present problem based at least in part on a pattern of failures of access management instruction and fulfillments, and suggests a correction to the problem. In some embodiments, recommendation engine  240  monitors the shared computing system and the customer internal application via incoming messages  210  for fulfillment of the access management instruction and the another access management instruction as well as patterns of access management instructions and fulfillments, predicts a future problem based at least in part on a pattern of failures of access management instruction and fulfillments, and suggests a correction to the problem. 
     In some embodiments, diagnosing, predicting or suggesting by recommendation engine  240  include diagnosing, predicting or suggesting based at least in part on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. In some embodiments, a data store management module  225  performs providing a data store  280  including an identity management access database. In some embodiments the providing a data store includes recording a listing of identities as data store updates  270 . For each identity of the listing of identities, data store management module  225  performs recording a set of peer and supervisory relationships between the identity and other identities of the listing of identities. For each identity of the listing of identities, data store management module  225  performs recording previously requested access entitlement operations. 
     In some embodiments, user interface module  255  performs offering through a user interface the suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations. In some embodiments, user interface module  255  performs calculating for each of the one or more identities with connection to the requesting user a likelihood of access entitlement operation request, ranking the one or more identities with connection to the requesting user according to the respective likelihood of access entitlement operation request, and providing a listing of the one or more identities with connection to the requesting user in order of the ranking. 
     In some embodiments, user interface module  255  performs calculating for each of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations a likelihood of access entitlement operation request, ranking the one or more identities with connection to the requesting user according to the respective likelihood of access entitlement operation request, and providing a listing of the one or more identities with connection to the requesting user in order of the ranking. 
     In some embodiments, user interface module  255  performs calculating for each of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations a likelihood of access entitlement operation request, ranking the one or more identities with connection to the requesting user according to the respective likelihood of access entitlement operation request, and providing a listing of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations in order of the ranking. 
       FIG. 2B  illustrates a recommendation module according to some embodiments. In some embodiments, recommendation module  240  includes a mining module  215 , a user interface export module  245  and a recommendation generation module  235 . In some embodiments, recommendation generation module performs generating suggested access entitlement operations for potential identities of the listing of identities on which to perform access entitlement operations. In some embodiments, the generating suggested access entitlement operations further includes analyzing a requesting user and one or more identities with connection to the requesting user to identify the potential identities of the listing of identities on which to perform access entitlement operations, analyzing the one or more identities with connection to the requesting user to identify patterns of access entitlement in the identity management access database, and based at least in part on the patterns of access entitlement in the identity management access database, selecting the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations. 
     In some embodiments, recommendation generation module  235  performs selecting the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations includes recommendation generation module  235  calculating a ratio of a number of identities with connection to the requesting user to a number of identities with connection to the requesting user having a particular access entitlement. In some embodiments, recommendation generation module  235  performs suggesting access entitlement operations for performance on peers of the requesting user based on recent changes to access entitlements held by other peers of the requesting user, and wherein said peers of the requesting user have similar manager and title as the requesting user. 
     In some embodiments, recommendation generation module  235  performs suggesting access entitlement operations for performance on peers of the requesting user based on access entitlements held by other peers of the requesting user. In some embodiments, recommendation generation module  235  performs suggesting access entitlement operations for performance on peers of the requesting user based on recent changes to access entitlements held by other peers of the requesting user, and wherein said peers of the requesting user have similar location to the requesting user. In some embodiments, recommendation generation module  235  performs suggesting access entitlement operations on peers of the requesting user. In some embodiments, recommendation generation module  235  performs suggesting access entitlement operations on direct reports of the requesting user. In some embodiments, recommendation generation module  235  performs ranking identities for suggestion of access entitlement operations based at least in part upon a date of identity creation or a date of most recent modification. 
     In some embodiments, a mining module is provided. Functions provided, in some embodiments, by mining module  215  include but are not limited to: 
     Function: Mine Tenant 
     
         
         
           
             Load what People and Entitlements the Provisioner is able to use from Tenant policies 
             Available Tenant HR Data being used for data mining 
             Maximum Role Permutations for Tenant 
             Maximum Entitlement Suggestions for Tenant
 
Function: Mine Person Demographic Data
 
             Takes as input the Provisionee(s) Person(s) 
             Return all the demographic data the Provisioner(s) Person(s) has
 
Function: Mine Role Permutations
 
             Takes as input all the Provisionee(s) Person(s) demographic data 
             Returns all that Provisionee(s) Person(s) role permutations up to Tenant maximum
 
Function: Mine Role Permutation Entitlements
 
             Takes as input the Provisionee(s) Person(s)&#39;s role permutations up to Tenant maximum 
             Appends another dimension to the Role Permutation data that
           Links the Entitlements the Provisionee(s) have in each role permutation   Does not link entitlements the Provisioner cannot see based of Tenant policies   
         
             Returns a Two dimensional array of Role Permutations and their linked Entitlements
 
Function: Mine Entitlement Suggestions
 
             Takes as input a Two dimensional array of Role Permutations and their linked Entitlements 
             Performs Entitlement Mining on each Role Permutation and Entitlement 
             Returns a sorted list of the most likely Entitlements the Provisioner is requesting for the Provisionee based off Entitlement Mining on each Role Permutation.
 
Function: Skew Entitlement Suggestions
 
             Takes and input the mined Entitlement suggestions output array 
             Returns a sorted list of the most likely Entitlements the Provisioner is requesting skewed by:
           Recently created entitlements at Tenant   Recently provisioned entitlement trends at Tenant   Recent Entitlements granted to Provisionee(s)&#39;s peers (People(s) with same manager as provisionee(s))   
         
             Skew results to recent entitlements provisioned by Provisioner
 
Function: Mine Tenant Policies
 
             Returns all the policies used by Tenant for Person suggestions
 
Function: Mine Person Suggestion
 
             Return all the People the Provisioner person is able to see based off Tenant policies
 
Function: Skew Person Suggestion
 
             Takes as input all the People the Provisioner person is able to see based off Tenant policies 
             Results skewed for recently created people (Heavily weighted) 
             Results skewed for people with recent change in HR data (Heavily weighted) 
             Results skewed for people with recent Manager changes (Heavily weighted) 
             Results skewed for people with recent Project Team/Group changes (Heavily weighted) 
             Results skewed based of social relationships at Tenant 
             Results skewed results for recent People acted on by Provisioner (Less likely to be selected) 
             Return ordered list of 6-9 (tenant specific) results for Identity management module UI 
           
         
       
    
     In some embodiments, recommendation generation module  235  provides tenant specific trend analysis. Recommendation generation module  235  is configurable to skew results to favor accesses that have been more frequently requested at Tenant recently. Recommendation generation module  235  is configurable to skew results to favor entitlements that have been more frequently requested by Provisioner recently. Recommendation generation module  235  is configurable to skew results to favor recently created entitlements at Tenant. Recommendation generation module  235  is configurable to skew results to favor People recently created, skew results to favor People with recent HR data changes, skew results to favor People with recent manager changes or skew results to favor People recently worked on by the Provisioner less. 
     In some embodiments, recommendation generation module  235  provides tenant specific social relationship analysis. Recommendation generation module  235  is configurable to skew results to favor entitlements that have been more frequently requested by the peers of the provisionee(s) (and possibly other relationships defined on a tenant basis). Recommendation generation module  235  is configurable to skew results to favor People with recent Project Team/Group changes skew results to favor People with Social Relationships to peer. Recommendation generation module  235  is configurable to track data to build and adapt social relationships over time for relationships like:
         Admin/Executive   HR/Help Desk       

     In some embodiments, recommendation generation module  235  tracks tenant specific SOD violations. In some embodiments, any entitlement that, after being created, would cause a SOD violation for the Provisionee(s) will be removed from the result set. In some embodiments, recommendation generation module  235  generates results skewed for “pinned” Quick Actions to appear at the top of results, to return a sorted list of most likely Quick Action to be used from Quick Action use history, and to skew for Quick Actions most recently created. 
     In some embodiments, recommendation engine  240  is built such that use case functionality is achieved using Java and Cypher languages during transactions, run-Time code uses only temporary arrays as data storage, and post-run code will store transactional data for trend, social relationship, and historical analysis (Suggestions used, time to complete workflow, who works on/with who) in the identity management model back end (data store  280 ). In embodiments supporting web interfaces identity management model web UIs access recommendation engine  240  through an API. 
       FIG. 3A  is a flowchart of operations used in providing recommendations of identity management operations, according to some embodiments. A data store including an identity management access database is provided (block  300 ). Suggested access entitlement operations for potential identities of the listing of identities on which to perform access entitlement operations are generated (block  302 ). The suggested access entitlement operations for the potential identities of the listing of identities on which to perform access entitlement operations are offered through a user interface (block  304 ). 
       FIG. 3B  is a flowchart of operations used in performing identity management with a unified management interface across internal and shared computing applications, according to some embodiments. A plurality of access management requests is received at an identity management interface (block  310 ). An access management instruction is transmitted to a customer internal application via an on-premise proxy (block  312 ). In some embodiments, the access management instruction performs an access management operation indicated in a request of the plurality. Another access management instruction is transmitted to a shared computing system application via a multi-customer gateway on the shared computing system (block  314 ). In some embodiments, the another access management instruction performs another access management operation indicated in another request of the plurality. 
       FIG. 3C  is a flowchart of operations used in suggesting an access entitlement operation, according to some embodiments.  FIG. 3C  illustrates one example of a use case implemented by some embodiments. In this use case the Provisioner Person will have will receive a list of likely Entitlements they wish to grant the Provisionee Person during a Request Access workflow. 
     In this use case the Provisioner Person will have will receive a list of likely Entitlements they wish to grant the Provisionee Person during a Request Access workflow. 
     In one embodiment,  FIG. 3C  illustrates a use case to support the following actors:
         Tenant: A particular customer   Person: A Person in the Tenants authoritative source   Provisioner: Person acting on behalf of another Person to request access   Provisionee: Person who the Access Request is being acted on       

       FIG. 3C  illustrates a use case assuming the following precoditions:
         Identity Mapping has been complete for Tenant:
           Person data including Person, PersonAttribute, and PersonAttributeDefinition nodes have been created from Authoritative Source   Demographic data attributes have been defined and locked down for Person data
               (Suggested) Required: Location, Country, City, JobCode, UserType, Department, CostCenter, Title   (Suggested) Optional: Postal Code, StateProvince, TimeZone, Language   Optional: Role   
               Account and Entitlement data including Account and Privilege nodes have been created from target systems   
           Tenant static configurations have been configured (number of results, hr attributes, mining options ect.)   Tenant Access Catelog has been built   Tenant Social Relationships have been optionally built   Tenant Entitlement provisioning history is stored for trend analysis   Provisioner&#39;s has identified the target Tenant and Person for Entitlement   Tenant data is stored in a static configuration       

     Suggestion code is hit with tenant and person to perform data mining on for suggestion (block  320 ). Tenant data is loaded (block  322 ). A determination is made as to whether there is an error loading tenant data (block  324 ). If an error was received, the error is returned and a tenant load error is logged (block  326 ). If no error was received, entitlement suggestion mining is performed (block  328 ). A determination is made as to whether there is failure during entitlement mining/suggestion validation (block  330 ). If an error was received, the error is returned and an entitlement mapping error is logged (block  332 ). If no error was received, a suggestion list is returned to the identity management module (Identity management module) to be used in an access request form. Workflow and suggestion use data are logged (block  334 ). 
     In one embodiment,  FIG. 3C  illustrates a use case resulting in the following postconditions:
         Baseline results for suggested entitlements from Role Mining   Results skewed for recently added entitlements to Tenant   Results skewed results for top most commonly requested entitlements recently at the Tenant   Results skewed results for recent Entitlements granted to Provisionee&#39;s peers (People with same manager as provisionee)   Results skewed results to recent entitlements provisioned by Provisioner   Ordered list of 6-9 (tenant specific) results for Identity management module UI to display to the Provisioner   Data is logged to track and adapt social relationships, suggestion usage, and workflow completion time       

       FIG. 3D  is a flowchart of operations used in suggesting a user for an access entitlement operation, according to some embodiments.  FIG. 3D  illustrates one example of a use case implemented by some embodiments. In this use case, when the user goes to the ‘pick user’ screen to pick a beneficiary, the ‘Suggestions’ list would show a list of persons that it is most likely the user wants to create a request for (excluding the Provisioner). 
     In one embodiment,  FIG. 3D  illustrates a use case to support the following actors:
         Tenant: A particular customer   Person: A Person in the Tenants authoritative source   Provisioner: Person acting on behalf of another Person to request access   Provisionee: Person who the Access Request is being acted on   Provisionee Community: All the possible Persons to be acting on by the Provisioner       

       FIG. 3D  illustrates a use case assuming the following precoditions:
         People have been created   Recently created People is mineable   Recent People with HR changes is mineable   Recent People with Manager changes is mineable   Recent People with Project Team/Group change is minable (future?)   Recent People acted on by Provisioner is mineable (Less likely to get Request)   Tenant Social Relationship policies have been defined   Tenant Catalog has been built       

     Suggestion code is hit with tenant and provisioner person to perform data mining on for provisionee person suggestion (block  340 ). Tenant data is loaded (block  342 ). A determination is made as to whether there is an error loading tenant data (block  344 ). If an error was received, the error is returned and a tenant load error is logged (block  346 ). If no error was received, pick person mining based on social relationships and trend analysis is performed (block  348 ). A determination is made as to whether there is failure during person mining/suggestion validation (block  350 ). If an error was received, the error is returned and a person mapping error is logged (block  352 ). If no error was received, a suggestion list is returned to the identity management module (Identity management module) to be used in an access request form. Workflow and suggestion use data are logged (block  354 ). 
     In one embodiment,  FIG. 3D  illustrates a use case resulting in the following postconditions:
         Baseline results for suggested People from People Provisioner can see based off Tenant policies   Results skewed for recently created people (Heavily weighted)   Results skewed for people with recent change in HR data (Heavily weighted)   Results skewed for people with recent Manager changes (Heavily weighted)   Results skewed for people with recent Project Team/Group changes (Heavily weighted)   Results skewed results for recent People acted on by Provisioner (Less likely to be selected)   Returns ordered list of 6-9 (tenant specific) results for Identity management module UI to display to the Provisioner   Data is logged to track and adapt social relationships, suggestion usage, and workflow completion time       

       FIG. 3E  is a flowchart of operations used in suggesting a “quick action” access entitlement operation, according to some embodiments.  FIG. 3E  illustrates one example of a use case implemented by some embodiments. 
     In some embodiments, throughout the identity management module application, a set of operations will be classified as Quick Actions. These represent functional wizards/forms that the user can launch to accomplish some activity in ScL, like Changing Master Password, Requesting Access for Self, Creating a Person, etc. These Quick Actions can show up in multiple places in the UI. 
     In one embodiment,  FIG. 3E  illustrates a use case to support the following actors:
         Tenant: A particular customer   Person: A Person in the Tenants authoritative source   Provisioner: Person acting on behalf of another Person to request access       

       FIG. 3E  illustrates a use case assuming the following precoditions:
         Quick Actions have been Created   Use of Quick Actions is mineable       

     Suggestion code is hit with tenant and provisioner person to perform data mining on for quick action suggestion (block  360 ). Tenant data is loaded (block  362 ). A determination is made as to whether there is an error loading tenant data (block  364 ). If an error was received, the error is returned and a tenant load error is logged (block  366 ). If no error was received, pick person mining based on social relationships and trend analysis is performed (block  368 ). A determination is made as to whether there is failure during quick action mining/suggestion validation (block  370 ). If an error was received, the error is returned and a quick action mining error is logged (block  372 ). If no error was received, a suggestion list is returned to the identity management module (Identity management module) to be used in quick action selection. Workflow and suggestion use data are logged (block  374 ). 
     In one embodiment,  FIG. 3E  illustrates a use case resulting in the following postconditions:
         An ordered list of most likely to be used Quick Actions is displayed to the Provisioner   Data is logged to track Quick Action usage and workflow completion time       

       FIG. 4A  is a flowchart of operations used in providing a data store including an identity management access database, according to some embodiments. A listing of identities is recorded (block  400 ). For each identity of the listing of identities, a set of peer and supervisory relationships between the identity and other identities of the listing of identities is recorded (block  402 ). For each identity of the listing of identities, previously requested access entitlement operations (block  404 ). 
       FIG. 4B  is a flowchart of operations used in generating suggested access entitlement operations, according to some embodiments. A requesting user and one or more identities with connection to the requesting user are analyzed to identify the potential identities of the listing of identities on which to perform access entitlement operations (block  410 ). The one or more identities with connection to the requesting user are analyzed to identify patterns of access entitlement in the identity management access database (block  412 ). Based at least in part on the patterns of access entitlement in the identity management access database, the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations are selected (block  414 ). 
       FIG. 4C  is a flowchart of operations used in offering through a user interface the suggested access entitlement, according to some embodiments. For each of the one or more identities with connection to the requesting user, a likelihood of access entitlement operation request is calculated (block  420 ). One or more identities with connection to the requesting user are ranked according to the respective likelihood of access entitlement operation request (block  422 ). A listing of the one or more identities with connection to the requesting user in order of the ranking is provided (block  424 ). 
       FIG. 4D  is a flowchart of operations used in offering through a user interface the suggested access entitlement, according to some embodiments. for each of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations a likelihood of access entitlement operation request is calculated (block  430 ). The one or more identities with connection to the requesting user are ranked according to the respective likelihood of access entitlement operation request (block  432 ). A listing of the one or more identities with connection to the requesting user in order of the ranking is provided (block  434 ). 
       FIG. 4E  is a flowchart of operations used in offering through a user interface the suggested access entitlement, according to some embodiments. For each of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations a likelihood of access entitlement operation request is calculated (block  440 ). The one or more identities with connection to the requesting user are ranked according to the respective likelihood of access entitlement operation request (block  442 ). A listing of the suggested access entitlement operations for each of the potential identities of the listing of identities on which to perform access entitlement operations in order of the ranking is provided (block  444 ). 
       FIG. 5A  is a flowchart of operations used in performing identity management with a unified management interface across internal and shared computing applications, according to some embodiments. A plurality of access management requests is received at an identity management interface (block  500 ). An access management instruction is transmitted to a customer internal application via an on-premise proxy by transmitting the access management instruction from an access management module located external to a firewall to an on premise proxy internal to the firewall (block  502 ). Another access management instruction is transmitted to a shared computing system application via a multi-customer gateway on the shared computing system by transmitting the access management instruction from the access management module located external to the firewall to the multi-customer gateway located external to the firewall (block  504 ). 
       FIG. 5B  is a flowchart of operations used in performing monitoring functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. A plurality of access management requests is received at an identity management interface (block  510 ). An access management instruction of the plurality is transmitted to a customer internal application via an on-premise proxy (block  512 ). Another access management instruction of the plurality is transmitted to a shared computing system application via a multi-customer gateway on the shared computing system (block  514 ). The shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction (block  516 ). 
       FIG. 6  is a flowchart of operations used in performing diagnostic functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. The shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction (block  600 ). A present problem is diagnosed based on a failure of fulfillment of the access management instruction or the another access management instruction (block  602 ). A correction to the problem is suggested (block  604 ). 
       FIG. 7  is a flowchart of operations used in performing diagnostic functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. The shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction as well as patterns of access management instructions and fulfillments (block  700 ). A present problem is diagnosed based on a pattern of failures of access management instruction and fulfillments (block  702 ). A correction to the problem is suggested (block  704 ). 
       FIG. 8  is a flowchart of operations used in performing predictive diagnostic functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. The shared computing system and the customer internal application are monitored for fulfillment of the access management instruction and the another access management instruction as well as patterns of access management instructions and fulfillments (block  800 ). A future problem based on a pattern of failures of access management instruction and fulfillments (block  802 ). A correction to the problem is suggested (block  804 ). 
       FIG. 9  is a flowchart of operations used in performing predictive functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. A single user interface including options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system is presented (block  900 ). The user interface is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine (block  902 ). 
       FIG. 10  is a flowchart of operations used in performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. An identity management access database is exposed to a prediction engine (block  1000 ). Expected access entitlements of an identity are predicted in response to discovery of patterns in the identity management access database (block  1002 ). Access entitlement operations are suggested based at least in part upon the expected access entitlements (block  1004 ). 
       FIG. 11  is a graphical user interface for performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. User interface  1100  is a dashboard interface. Upon presentation, user interface  1100  presents a quick actions toolbar  1105 , which immediately informs the user listed in a user identity segment  1110  of suggested (quick) actions  1115 , which are suggested based upon recommendations from a recommendation engine. This is based on the end user&#39;s identity data, as reported in a profile that can be accessed through a profile control  1120  and past behavior (most frequently used actions). Examples of profile data can include a user&#39;s name, title and department, direct reports, with links to access their profiles. A summary notification presents notification of events requiring user action, such notifications  1130 , draft requests  1135 , and pending requests  1140 . A todo list  1145  is presented, showing various items  1150  requiring user attention. User interface  1100  also includes a control for accessing an access request interface  1155 , which triggers display of the screen shown in  FIG. 12 . 
       FIG. 12  is a graphical user interface for performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. Upon presentation in response to actuation of a control for accessing an access request interface  1205 , user interface  1200  presents an access request interface  1210  for processing through a control for selecting a user  1215 , a control for selecting access  1220 , a control for providing details  1225 , and a control for confirming an access request  1230 . When the user actuates the suggestions control  1235  in the access request interface  1210 , the recommendation engine determines, based on the end user&#39;s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user (the requester) may want to request access. The most likely users  1240  are presented in a user list  1245 . A user is also able to request a list of direct reports through a direct reports control  1250 , to search for a particular user with a search control  1255 , or to request access for the user through a request for myself control  1260 . 
     In some embodiments, access request interface  1210  performs adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon interactions between search criteria, browsing of categories, user identity and/or past behavior. In some embodiments, access request interface  1210  performs adaptively adjusting the user interface  1200  to highlight suggested access entitlement operations by adaptively adjusting the user interface  1600  such that, when the user clicks on suggestions  1235 , in access request interface  1210 , the recommendation engine determines, based on the end user&#39;s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user may want to request access in a user list  1245 . 
       FIG. 13  is a graphical user interface for performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. Upon presentation in response to actuation of a control for accessing an access request interface  1305 , user interface  1300  presents an access request interface  1310  for processing through a control for selecting a user  1315 , a control for selecting access  1320 , a control for providing details  1325 , and a control for confirming an access request  1330 . After selecting two users on behalf which to make the request, the requester clicks on suggestions  1335 , and the recommendation engine determines the most likely entitlements that the requester would want to request based on requester&#39;s identity data, target users (requestees) identity data and behavioral patterns (i.e. based on last requests). In this case timesheeting  1340  and email  1345  are suggested. A catalog of entitlements may be browsed using a browse catalog control  1350 , or a search may be performed using a search control  1355 . After a completion of entry details, a draft may be saved using a save draft control  1360 . 
     Responsive to receiving a plurality of access management requests  1340  and  1345  at an identity management interface (user interface  1300 ), an identity management module will transmit an access management instruction to a customer internal application via an on-premise proxy and transmit another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system, as described herein. 
       FIG. 14  is a graphical user interface showing a metric used for suggesting an access entitlement in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. User interface  1400  presents reporting options  1405  for displaying data  1410  related to behavioral patterns of system users, which data can be used for adaptively adjusting a user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine. A tool for showing trends by department  1415  is displayed. 
     In some embodiments, data  1410  is used for adaptively adjusting the user interface to highlight suggested access entitlement operations by adaptively adjusting the user interface based at least in part upon user identity and past behavior, where affiliation with a particular department is one example of identity. Data can likewise be organized by target system, provisioning trends, location demographics, employee title demographics, cost center demographics, source availability trends, types of operations being performed, timing of requests for various forms of access, or other significant indicators of trends. In some embodiments, data  1410  is used to facilitate adaptively adjusting the user interface such that, when the user clicks on suggestions, in the access request interface, the recommendation engine determines, based on the end user&#39;s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user may want to request access. In some embodiments, data  1410  is used for adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine by adaptively adjusting the user interface to highlight suggested access entitlement operations based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. 
     In some embodiments, data  1410  is used for adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine by presenting a next selected operation based on patterns in an identity management access database discerned by a learning-based prediction engine. In some embodiments, data  1410  is used for adaptively adjusting the user interface to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine by presenting a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface. 
       FIG. 15  is a graphical user interface for requesting an access entitlement in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. A user interface  1500  provides a browsing pane  1505  listing options for requesting access entitlements  1510 . Sales role entitlement  1530 , which sets up access on a Salesforce.com™ account, is one example of an option for transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. 
     In some embodiments, browsing pane  1505  performs adaptively adjusting the user interface to highlight suggested access entitlement operations (options for requesting access entitlements  1510 ) based at least in part upon expected access entitlements derived from a prediction engine. For example, options for requesting access entitlements  1510  may be displayed in browsing pane  1505  or positioned for display in browsing pane  1505  based on frequency or recency of use by the user of user interface  1500 . As such, the adaptively adjusting the user interface  1500  to highlight suggested access entitlement operations may include adaptively adjusting the user interface based at least in part upon user identity and/or past behavior. 
     In some embodiments, adjusting the user interface based at least in part upon user identity includes adjusting the user interface based at least in part upon the user identity of the user being prompted to select access entitlements. In some embodiments, adjusting the user interface based at least in part upon user identity includes adjusting the user interface based at least in part upon user identity of the persons for whom access is being selected. In some embodiments, identity adjusting the user interface based at least in part upon user identity includes individual personality of the identity, while in some embodiments, identity includes adjusting the user interface based at least in part upon user identity includes adjusting the user interface based at least in part upon shared attributes, such as demographics, commonly performed actions, or trends applicable to users based on shared characteristics. 
     In some embodiments, adjusting the user interface based at least in part upon past behavior includes adjusting the user interface based at least in part upon the past behavior of the user being prompted to select access entitlements. In some embodiments, adjusting the user interface based at least in part upon past behavior includes adjusting the user interface based at least in part upon past behavior of the persons for whom access is being selected. In some embodiments, identity adjusting the user interface based at least in part upon past behavior includes adjusting the user interface based at least in part upon shared attributes, such as demographics, commonly performed actions, or trends applicable to users based on shared characteristics of past behavior. 
     In some embodiments, a search box  1540  and a set of browsing category controls  1545  are provided. Entry of a search string into search box  1540  causes options for requesting access entitlements  1510  complying with the search string to be displayed in browsing pane  1505 . Likewise, actuation of one of browsing category controls  1545  causes options for requesting access entitlements  1510  of the represented category to be displayed in browsing pane  1505 . In some embodiments, interaction between requests from search box  1540  and a set of browsing category controls  1545  are supported. For example, if a user enters a search string in search box  1540  and then actuates one of browsing category controls  1545 , results to be displayed in browsing pane  1505  are filtered first according to the search string and then according to the selected category. A reverse option where searching is performed after category filtering is also supported. For example, if a user enters a search string in search box  1540  after the user actuates one of browsing category controls  1545 , results to be displayed in browsing pane  1505  are filtered first according to the selected category and then according to the search string. Likewise, options for requesting access entitlements  1510  may be displayed in browsing pane  1505  or positioned for display in browsing pane  1505  based on frequency of use by the user of user interface  1500  after such a dual-filtering operation. 
     In some embodiments, browsing pane  1505  performs adaptively adjusting the user interface  1500  to highlight suggested access entitlement operations based at least in part upon expected access entitlements  1510  derived from a prediction engine by adaptively adjusting the user interface  1500  to highlight suggested access entitlement operations  1510  based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. In some embodiments, browsing pane  1505  performs adaptively adjusting the user interface  1500  to highlight suggested access entitlement operations  1510  based at least in part upon expected access entitlements derived from a prediction engine by presenting a next selected operation based on patterns in an identity management access database discerned by a learning-based prediction engine. In some embodiments, browsing pane  1505  performs adaptively adjusting the user interface  1500  to highlight suggested access entitlement operations  1510  based at least in part upon expected access entitlements derived from a prediction engine by presenting a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface. 
       FIG. 16  is a graphical user interface for requesting an access entitlement in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. A user interface  1600  provides a browsing pane  1605  listing options for requesting access entitlements  1610 . A summary pane  1615  lists access entitlements requested  1620  as well as users for which an entitlement is requested  1625 . Access entitlements requested  1620  include both options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and options for transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. Sales role entitlement  1630 , which sets up access on a Salesforce.com™ account, is one example of an option for transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. Email entitlement  1635 , which sets up access on a local email server, is one example of an option for transmitting an access management instruction to a customer internal application via an on-premise proxy. 
     In some embodiments, browsing pane  1605  performs adaptively adjusting the user interface to highlight suggested access entitlement operations (options for requesting access entitlements  1610 ) based at least in part upon expected access entitlements derived from a prediction engine. For example, options for requesting access entitlements  1610  may be displayed in browsing pane  1605  or positioned for display in browsing pane  1605  based on frequency of use by the user of user interface  1600 . As such, the adaptively adjusting the user interface  1600  to highlight suggested access entitlement operations may include adaptively adjusting the user interface based at least in part upon user identity and/or past behavior. 
     In some embodiments, adjusting the user interface based at least in part upon user identity includes adjusting the user interface based at least in part upon the user identity of the user being prompted to select access entitlements. In some embodiments, adjusting the user interface based at least in part upon user identity includes adjusting the user interface based at least in part upon user identity of the persons for whom access is being selected. In some embodiments, identity adjusting the user interface based at least in part upon user identity includes individual personality of the identity, while in some embodiments, identity includes adjusting the user interface based at least in part upon user identity includes adjusting the user interface based at least in part upon shared attributes, such as demographics, commonly performed actions, or trends applicable to users based on shared characteristics. 
     In some embodiments, adjusting the user interface based at least in part upon past behavior includes adjusting the user interface based at least in part upon the past behavior of the user being prompted to select access entitlements. In some embodiments, adjusting the user interface based at least in part upon past behavior includes adjusting the user interface based at least in part upon past behavior of the persons for whom access is being selected. In some embodiments, identity adjusting the user interface based at least in part upon past behavior includes adjusting the user interface based at least in part upon shared attributes, such as demographics, commonly performed actions, or trends applicable to users based on shared characteristics of past behavior. 
     In some embodiments, a search box  1640  and a set of browsing category controls  1645  are provided. Entry of a search string into search box  1640  causes options for requesting access entitlements  1610  complying with the search string to be displayed in browsing pane  1605 . Likewise, actuation of one of browsing category controls  1645  causes options for requesting access entitlements  1610  of the represented category to be displayed in browsing pane  1605 . In some embodiments, interaction between requests from search box  1640  and a set of browsing category controls  1645  are supported. For example, if a user enters a search string in search box  1640  and then actuates one of browsing category controls  1645 , results to be displayed in browsing pane  1605  are filtered first according to the search string and then according to the selected category. A reverse option where searching is performed after category filtering is also supported. For example, if a user enters a search string in search box  1640  after the user actuates one of browsing category controls  1645 , results to be displayed in browsing pane  1605  are filtered first according to the selected category and then according to the search string. Likewise, options for requesting access entitlements  1610  may be displayed in browsing pane  1605  or positioned for display in browsing pane  1605  based on frequency of use by the user of user interface  1600  after such a dual-filtering operation. 
     In some embodiments, browsing pane  1605  performs presenting the single user interface  1600  including the options for transmitting the access management instruction to the customer internal application (email entitlement  1635 ) via the on-premise proxy, and the transmitting the another access management instruction to the shared computing system application (sales role entitlement  1630 ) via the multi-customer gateway on the shared computing system by presenting the user interface  1600  in a platform-agnostic fashion such that user controls do not a user of the single user interface  1600  as to whether a particular option invokes transmission to a shared computing system or a customer internal application. 
     In some embodiments, browsing pane  1605  performs adaptively adjusting the user interface  1600  to highlight suggested access entitlement operations based at least in part upon expected access entitlements  1610  derived from a prediction engine by adaptively adjusting the user interface  1600  to highlight suggested access entitlement operations  1610  based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. In some embodiments, browsing pane  1605  performs adaptively adjusting the user interface  1600  to highlight suggested access entitlement operations  1610  based at least in part upon expected access entitlements derived from a prediction engine by presenting a next selected operation based on patterns in an identity management access database discerned by a learning-based prediction engine. In some embodiments, browsing pane  1605  performs adaptively adjusting the user interface  1600  to highlight suggested access entitlement operations  1610  based at least in part upon expected access entitlements derived from a prediction engine by presenting a next selected operation based on auditing an identity management access database using a learning-based prediction engine to assess priority of operations that can be performed by a user of the user interface. 
       FIG. 17  is a graphical user interface for approving an access entitlement in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. User interface  1700  provides details of a request  1705 . Requests may be presented in an order selected as a part of presenting a next selected operation based on patterns in an identity management access database discerned by a learning-based prediction engine. User interface  1700  provides details of requesting party and provides an interface for providing an approval  1720  and justification for the approval. If multiple approvals are required, an approval chain area  1725  may display the set of multiple approvals required. In some embodiments, user interface is presented in a web browser window  1730 , which is capable of being displayed on any platform supporting web browser execution, ranging from full-size computers to dedicated terminals or mobile phones or tablets. In other embodiments, a standalone application (or app) may be provided. 
       FIG. 18  is a graphical user interface for managing access entitlements in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. Upon presentation, user interface  1800  presents a quick actions toolbar  1805 , which immediately informs the user listed in a user identity segment  1810  of suggested (quick) actions  1815 , which are suggested based upon recommendations from a recommendation engine. This is based on the end user&#39;s identity data, as reported in a profile that can be accessed through a profile control  1820  and past behavior (most frequently used actions). Examples of profile data can include a user&#39;s name, title and department, direct reports, with links to access their profiles. A summary notification  1830  presents notification of events requiring user action, such notifications, draft requests, and pending requests. A todo list  1845  is presented, showing various items requiring user attention. 
     In some embodiments, user interface  1800  is presented to a user of an identity management module. In some embodiments the user interface is a single user interface including options (suggested (quick) actions  1815 ) for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. In some embodiments, the user interface is adaptively adjusted to highlight suggested access entitlement operations (suggested (quick) actions  1815  or todo list  1845 ) based at least in part upon expected access entitlements derived from a prediction engine. 
     In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations further includes adaptively adjusting the user interface based at least in part upon user identity  1810  and past behavior. In some embodiments, the adaptively adjusting the user interface to highlight suggested access entitlement operations (suggested (quick) actions  1815  or todo list  1845 ) further comprises adaptively adjusting the user interface such that, when the user clicks on suggestions (suggested (quick) actions  1815  or todo list  1845 ), in the access request interface, the recommendation engine determines, based on the end user&#39;s identity data, as well as behavioral patterns over the last interactions, who are the most likely users for which the end user (the requester) may want to request access. 
     In some embodiments, the adaptively adjusting the user interface  1800  to highlight suggested access entitlement operations further includes the presenting the single user interface including the options for transmitting the access management instruction to the customer internal application via the on-premise proxy, and the transmitting the another access management instruction to the shared computing system application via the multi-customer gateway on the shared computing system further includes presenting the user interface in a platform-agnostic fashion such that user controls do not inform a user of the single user interface as to whether a particular option invokes transmission to a shared computing system or a customer internal application. 
     In some embodiments, the adaptively adjusting the user interface  1800  to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further includes adaptively adjusting the user interface  1800  to highlight suggested access entitlement operations based on a neural networks prediction engine accessing runtime-data to make predictions based on changes in usage patterns. 
       FIG. 19  is a graphical user interface for managing access entitlements in a system performing adaptive user interface functions in identity management with a unified management interface across internal and shared computing applications, according to some embodiments. User interface  1900  illustrates a tile paradigm for a identity management user interface in accordance with some embodiments. Upon presentation, user interface  1900  presents a workflow toolbar  1905 , for tracking progress through one or more entitlement operations, which are suggested based upon recommendations from a recommendation engine, as described herein. 
     A teams toolbar  1910  suggests assignment of a user to one of several teams  1915   a - 1915   c , with corresponding entitlement operations resulting from the assignment to the team. In some embodiments, teams  1915   a - 1915   c  for selection (and activation of corresponding access entitlement operations) are suggested based upon recommendations from a recommendation engine, as described herein. 
     A roles toolbar  1920  suggests assignment of a user to one of several roles  1925   a - 1925   c , with corresponding entitlement operations resulting from the assignment to the role. In some embodiments, roles  1925   a - 1925   c  for selection (and activation of corresponding access entitlement operations) are suggested based upon recommendations from a recommendation engine, as described herein. 
     An applications toolbar  1930  suggests assignment of a user to one of several applications  1935   a - 1935   c , with corresponding entitlement operations resulting from the assignment to the application. In some embodiments, application  1935   a - 1935   c  for selection (and activation of corresponding access entitlement operations) are suggested based upon recommendations from a recommendation engine, as described herein. 
     Suggestions in user interface  1900  may be spatially arranged based on any criteria available to the recommendation engine, such as the end user&#39;s identity data, and past behavior (most frequently used actions), which may control both spatial placement of toolbars  1910 ,  1920  and  1930  and spatial placement of individual options and  1915   a - 1915   c ,  1925   a - 1925   c , and  1935   a - 1935   c . Other data example available to the recommendation engine as the basis for suggestions include a user&#39;s name, title and department, direct reports, with links to access their profiles. 
     In some embodiments, user interface  1900  is presented to a user of an identity management module. In some embodiments the user interface is a single user interface including options for transmitting an access management instruction to a customer internal application via an on-premise proxy, and transmitting another access management instruction to a shared computing system application via a multi-customer gateway on the shared computing system. In some embodiments, the user interface is adaptively adjusted to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine, as described herein. 
     In some embodiments, the adaptively adjusting the user interface  1900  to highlight suggested access entitlement operations further includes the presenting the single user interface including the options for transmitting the access management instruction to the customer internal application via the on-premise proxy, and the transmitting the another access management instruction to the shared computing system application via the multi-customer gateway on the shared computing system, which further includes presenting the user interface in a platform-agnostic fashion such that user controls do not inform a user of the single user interface as to whether a particular option invokes transmission to a shared computing system or a customer internal application. 
     In some embodiments, the adaptively adjusting the user interface  1900  to highlight suggested access entitlement operations based at least in part upon expected access entitlements derived from a prediction engine further includes adaptively adjusting the user interface  1900  to highlight suggested access entitlement operations. 
     Example System 
     Embodiments of an identity management module and/or of the various identity management techniques as described herein may be executed on one or more computer systems, which may interact with various other devices. One such computer system is illustrated by  FIG. 20 . In different embodiments, computer system  2000  may be any of various types of devices, including, but not limited to, a personal computer system, desktop computer, laptop, notebook, or netbook computer, mainframe computer system, handheld computer, workstation, network computer, a camera, a set top box, a mobile device, a consumer device, video game console, handheld video game device, application server, storage device, a peripheral device such as a switch, modem, router, or in general any type of computing or electronic device. 
     In the illustrated embodiment, computer system  2000  includes one or more processors  2010  coupled to a system memory  2020  via an input/output (I/O) interface  2030 . Computer system  2000  further includes a network interface  2040  coupled to I/O interface  2030 , and one or more input/output devices  2050 , such as cursor control device  2060 , keyboard  2070 , and display(s)  2080 . In some embodiments, it is contemplated that embodiments may be implemented using a single instance of computer system  2000 , while in other embodiments multiple such systems, or multiple nodes making up computer system  2000 , may be configured to host different portions or instances of embodiments. For example, in one embodiment some elements may be implemented via one or more nodes of computer system  2000  that are distinct from those nodes implementing other elements. 
     In various embodiments, computer system  2000  may be a uniprocessor system including one processor  2010 , or a multiprocessor system including several processors  2010  (e.g., two, four, eight, or another suitable number). Processors  2010  may be any suitable processor capable of executing instructions. For example, in various embodiments, processors  2010  may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs), such as the x86, PowerPC, SPARC, or MIPS ISAs, or any other suitable ISA. In multiprocessor systems, each of processors  2010  may commonly, but not necessarily, implement the same ISA. 
     System memory  2020  may be configured to store program instructions and/or data accessible by processor  2010 . In various embodiments, system memory  2020  may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), nonvolatile/Flash-type memory, or any other type of memory. In the illustrated embodiment, program instructions and data implementing desired functions, such as those described above for embodiments of an identity management module are shown stored within system memory  2020  as program instructions  2025  and data storage  2035 , respectively. In other embodiments, program instructions and/or data may be received, sent or stored upon different types of computer-accessible media or on similar media separate from system memory  2020  or computer system  2000 . Generally speaking, a computer-accessible medium may include storage media or memory media such as magnetic or optical media, e.g., disk or CD/DVD-ROM coupled to computer system  2000  via I/O interface  2030 . Program instructions and data stored via a computer-accessible medium may be transmitted by transmission media or signals such as electrical, electromagnetic, or digital signals, which may be conveyed via a communication medium such as a network and/or a wireless link, such as may be implemented via network interface  2040 . 
     In one embodiment, I/O interface  2030  may be configured to coordinate I/O traffic between processor  2010 , system memory  2020 , and any peripheral devices in the device, including network interface  2040  or other peripheral interfaces, such as input/output devices  2050 . In some embodiments, I/O interface  2030  may perform any necessary protocol, timing or other data transformations to convert data signals from one component (e.g., system memory  2020 ) into a format suitable for use by another component (e.g., processor  2010 ). In some embodiments, I/O interface  2030  may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard, for example. In some embodiments, the function of I/O interface  2030  may be split into two or more separate components, such as a north bridge and a south bridge, for example. In addition, in some embodiments some or all of the functionality of I/O interface  2030 , such as an interface to system memory  2020 , may be incorporated directly into processor  2010 . 
     Network interface  2040  may be configured to allow data to be exchanged between computer system  2000  and other devices attached to a network, such as other computer systems, or between nodes of computer system  2000 . In various embodiments, network interface  2040  may support communication via wired or wireless general data networks, such as any suitable type of Ethernet network, for example; via telecommunications/telephony networks such as analog voice networks or digital fiber communications networks; via storage area networks such as Fibre Channel SANs, or via any other suitable type of network and/or protocol. 
     Input/output devices  2050  may, in some embodiments, include one or more display terminals, keyboards, keypads, touchpads, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or retrieving data by one or more computer system  2000 . Multiple input/output devices  2050  may be present in computer system  2000  or may be distributed on various nodes of computer system  2000 . In some embodiments, similar input/output devices may be separate from computer system  2000  and may interact with one or more nodes of computer system  2000  through a wired or wireless connection, such as over network interface  2040 . 
     As shown in  FIG. 20 , memory  2020  may include program instructions  2025 , configured to implement embodiments of an identity management module as described herein, and data storage  2035 , comprising various data accessible by program instructions  2025 . In one embodiment, program instructions  2025  may include software elements of embodiments of an identity management module as illustrated in the above Figures. Data storage  2035  may include data that may be used in embodiments. In other embodiments, other or different software elements and data may be included. 
     Those skilled in the art will appreciate that computer system  2000  is merely illustrative and is not intended to limit the scope of an identity management module as described herein. In particular, the computer system and devices may include any combination of hardware or software that can perform the indicated functions, including a computer, personal computer system, desktop computer, laptop, notebook, or netbook computer, mainframe computer system, handheld computer, workstation, network computer, a camera, a set top box, a mobile device, network device, internet appliance, PDA, wireless phones, pagers, a consumer device, video game console, handheld video game device, application server, storage device, a peripheral device such as a switch, modem, router, or in general any type of computing or electronic device. Computer system  1000  may also be connected to other devices that are not illustrated, or instead may operate as a stand-alone system. In addition, the functionality provided by the illustrated components may in some embodiments be combined in fewer components or distributed in additional components. Similarly, in some embodiments, the functionality of some of the illustrated components may not be provided and/or other additional functionality may be available. 
     Those skilled in the art will also appreciate that, while various items are illustrated as being stored in memory or on storage while being used, these items or portions of them may be transferred between memory and other storage devices for purposes of memory management and data integrity. Alternatively, in other embodiments some or all of the software components may execute in memory on another device and communicate with the illustrated computer system via inter-computer communication. Some or all of the system components or data structures may also be stored (e.g., as instructions or structured data) on a computer-accessible medium or a portable article to be read by an appropriate drive, various examples of which are described above. In some embodiments, instructions stored on a computer-accessible medium separate from computer system  2000  may be transmitted to computer system  2000  via transmission media or signals such as electrical, electromagnetic, or digital signals, conveyed via a communication medium such as a network and/or a wireless link. Various embodiments may further include receiving, sending or storing instructions and/or data implemented in accordance with the foregoing description upon a computer-accessible medium. Accordingly, the present invention may be practiced with other computer system configurations. 
     CONCLUSION 
     Various embodiments may further include receiving, sending or storing instructions and/or data implemented in accordance with the foregoing description upon a computer-accessible medium. Generally speaking, a computer-accessible medium may include storage media or memory media such as magnetic or optical media, e.g., disk or DVD/CD-ROM, volatile or non-volatile media such as RAM (e.g. SDRAM, DDR, RDRAM, SRAM, etc.), ROM, etc., as well as transmission media or signals such as electrical, electromagnetic, or digital signals, conveyed via a communication medium such as network and/or a wireless link. 
     The various methods as illustrated in the Figures and described herein represent example embodiments of methods. The methods may be implemented in software, hardware, or a combination thereof. The order of method may be changed, and various elements may be added, reordered, combined, omitted, modified, etc. 
     Various modifications and changes may be made as would be obvious to a person skilled in the art having the benefit of this disclosure. It is intended that the invention embrace all such modifications and changes and, accordingly, the above description to be regarded in an illustrative rather than a restrictive sense.