A computer-implemented method in a computing system for dynamically managing access to computer applications, comprising: receiving data containing application entitlements assigned to groups; receiving a plurality of group definitions, each of the group definitions expressing a group composition logic rule used to identify members of a said group through evaluation of the group composition logic rule; evaluating the group composition logic rule of each of the group definitions to generate a plurality of data repository queries; causing the data repository queries to be executed against one or more data repositories to determine one or more tables that map users to groups; receiving (812, 816) a user generated change to a user and/or a group; automatically propagating (814, 818) the change through the one or more tables that map users to groups, and granting access to the application to the members in one of the groups by: receiving from a user a request for access to an application; determining from the one or more tables that map users to groups whether the user is a member of an entitled group assigned to the application, the method characterised by: determining whether a said group composition logic rule is over-used, and if it is determined that the group composition logic rule is over-used then refactoring the group composition logic rule; determining whether a said group composition logic rule is under-used, and if it is determined that the group composition logic rule is under-used then refactoring the group composition logic rule, and determining whether a said group composition logic rule is inaccurate, and if it is determined that the group composition logic rule is inaccurate then refactoring the group composition logic rule. receiving data containing application entitlements assigned to groups; receiving a plurality of group definitions, each of the group definitions expressing a group composition logic rule used to identify members of a said group through evaluation of the group composition logic rule; evaluating the group composition logic rule of each of the group definitions to generate a plurality of data repository queries; causing the data repository queries to be executed against one or more data repositories to determine one or more tables that map users to groups; receiving (812, 816) a user generated change to a user and/or a group; automatically propagating (814, 818) the change through the one or more tables that map users to groups, and granting access to the application to the members in one of the groups by: receiving from a user a request for access to an application; determining from the one or more tables that map users to groups whether the user is a member of an entitled group assigned to the application, receiving from a user a request for access to an application; determining from the one or more tables that map users to groups whether the user is a member of an entitled group assigned to the application, the method characterised by: determining whether a said group composition logic rule is over-used, and if it is determined that the group composition logic rule is over-used then refactoring the group composition logic rule; determining whether a said group composition logic rule is under-used, and if it is determined that the group composition logic rule is under-used then refactoring the group composition logic rule, and determining whether a said group composition logic rule is inaccurate, and if it is determined that the group composition logic rule is inaccurate then refactoring the group composition logic rule. determining whether a said group composition logic rule is over-used, and if it is determined that the group composition logic rule is over-used then refactoring the group composition logic rule; determining whether a said group composition logic rule is under-used, and if it is determined that the group composition logic rule is under-used then refactoring the group composition logic rule, and determining whether a said group composition logic rule is inaccurate, and if it is determined that the group composition logic rule is inaccurate then refactoring the group composition logic rule.