## 1 Introduction  
With the rapid development of network-information technology and the comprehensive application of cloud computing and big data techniques, there is much storage and there are many exchanges in large-scale and complex information-management systems [1]. The mechanism to ensure the security of system data and user information has attracted much attention. An increasing number of enterprises and organizations have adopted role-based access control (RBAC) as their main access-control mechanism, as it makes security administration more flexible and manageable [2; 3; 4; 5; 6; 7]. With the successful implementations of RBAC systems, designing an effective, complete set of roles and constructing a good RBAC system have become critical tasks. As a solution to facilitate the process of migrating from a non-RBAC system to an RBAC system, role-engineering technology [8; 9] has been proposed. There are two main approaches: top-down [10] and bottom-up [11; 12; 13; 14; 15; 16]. In the former approach, roles are derived by carefully analyzing particular organization functions. While this approach can reflect the functional requirements of the organization well, it is time-consuming and labor-intensive. In the latter approach, roles are aggregated by applying data-mining techniques from existing user-permission assignments, and the architectural structure of RBAC can be automatically constructed. The bottom-up approach, also known as role mining, has gained considerable interest and popularity in recent years. [PERSON] et al. [17] converted role mining into a matrix-decomposition problem and presented the definition of a basic role mining problem (basic RMP), which attempts to find a minimal set of roles from bottom-user permission assignments and completely cover the original assignments. However, it is difficult to derive an optimal role set in practical applications. Afterward, a variant of basic RMP called \(\delta\)-approx RMP was proposed in the work of [17], which attempts to find a minimal set of roles by allowing a limited number of mismatches. As a result, it is easy to derive a suboptimal role set. Meanwhile, in min-noise RMP [17], the number of roles is bounded, and the number of mismatches between original assignments and assignments in the constructed system is minimized. According to different optimization objectives for role mining, many other approaches have been proposed, such as edge RMP [18], usage RMP [19], and user-oriented exact RMP [20]. A key characteristic of RBAC is that it allows the specification and enforcement of various constraint policies [21; 22; 23], such as cardinality constraints and separation-of-duty constraints (also called separation-of-duty policies), which can reflect security policies of different enterprises and organizations and ensure system security. The cardinality constraint limits the maximum number of roles related to users or to permissions, the maximum number of permissions a role can have, or the maximum number of users to which a role can be assigned [14]. Another significant constraint discussed in this paper is the separation-of-duty constraint, which is widely recognized to be a fundamental principle in computer security [14]. Typically, the constraint states that at least \(k\) users are required to complete a special task that requires \(n\) number of permissions. One approach requires that no \((k-1)\) users together have all the permissions needed to complete the task [24]. It has been widely used in the banking industry and military systems. In the approach to migrate from a non-RBAC system to an RBAC system, however, an inadequately addressed key challenge is that none of the conventional role-mining methods consider the separation-of-duty constraint. Furthermore, both the mutually-exclusive-role constraint and the least-privileges principle play important roles [25; 26] in evaluating system security and authorization performance in a constructed RBAC system.