A computer-implemented method for controlling access to a file system having data elements, comprising the steps of: maintaining a record of respective actual accesses by users of said file system to said data elements; defining a proposed removal of a set of said users from a superset of said users, wherein members of said superset have common access privileges to a portion of said data elements, and wherein following an implementation of said proposed removal, members of said set retain respective proposed residual access permissions to data elements they may need to access; automatically ascertaining, prior to said implementation of said proposed removal, whether, following the implementation of the proposed removal of a first member of the set of users from the superset of said users, the first member will retain residual access permissions to files to which the first member may need access to, wherein the step of automatically ascertaining comprises: identifying at least one similar user having a similar actual access profile to that of the first member of the set of users, said actual access profile being a collection of recent actual file accesses of a particular user; and determining whether revoking membership of the similar user results in revoking access permissions from the similar user to files which the similar user has recently actually accessed; and generating an error indication, responsively to said step of automatically ascertaining. maintaining a record of respective actual accesses by users of said file system to said data elements; defining a proposed removal of a set of said users from a superset of said users, wherein members of said superset have common access privileges to a portion of said data elements, and wherein following an implementation of said proposed removal, members of said set retain respective proposed residual access permissions to data elements they may need to access; automatically ascertaining, prior to said implementation of said proposed removal, whether, following the implementation of the proposed removal of a first member of the set of users from the superset of said users, the first member will retain residual access permissions to files to which the first member may need access to, wherein the step of automatically ascertaining comprises: identifying at least one similar user having a similar actual access profile to that of the first member of the set of users, said actual access profile being a collection of recent actual file accesses of a particular user; and determining whether revoking membership of the similar user results in revoking access permissions from the similar user to files which the similar user has recently actually accessed; and identifying at least one similar user having a similar actual access profile to that of the first member of the set of users, said actual access profile being a collection of recent actual file accesses of a particular user; and determining whether revoking membership of the similar user results in revoking access permissions from the similar user to files which the similar user has recently actually accessed; and generating an error indication, responsively to said step of automatically ascertaining.