A computer-implemented method for identifying ways to improve the security of a computer system, comprising: receiving structured access control data for the computer system from a database, wherein the access control data includes a plurality of subjects, a plurality of privileges and relationships among the subjects and the privileges; representing the access control data and the relationships in a binary array having at least two dimensions, wherein the binary array is an array of binary values, wherein a first dimension of the binary array represents the subjects and a second dimension of the binary array represents the privileges; receiving selections of operations to be performed on the binary array and an order of the operations, wherein the operations include permutation operations; performing operations according to the selections, including, permuting entries of the binary array, wherein the permuting comprises bringing the entries into a logical order while maintaining the relationships, wherein the operations include the following: sorting entries of the binary array; clustering entries of the binary array; identifying outliers in the entries of the binary array; identifying an access control improvement based on the logical order of the entries, wherein the access control improvement is one of the following: privilege consolidation, or identification of an outlying privilege and a privileged subject; wherein the privilege consolidation comprises: identifying one of the clusters of entries, wherein the identified cluster indicates that a plurality of privileges have each been assigned to multiple subjects; identifying a role that can be assigned to the plurality of privileges. receiving structured access control data for the computer system from a database, wherein the access control data includes a plurality of subjects, a plurality of privileges and relationships among the subjects and the privileges; representing the access control data and the relationships in a binary array having at least two dimensions, wherein the binary array is an array of binary values, wherein a first dimension of the binary array represents the subjects and a second dimension of the binary array represents the privileges; receiving selections of operations to be performed on the binary array and an order of the operations, wherein the operations include permutation operations; performing operations according to the selections, including, permuting entries of the binary array, wherein the permuting comprises bringing the entries into a logical order while maintaining the relationships, wherein the operations include the following: sorting entries of the binary array; clustering entries of the binary array; sorting entries of the binary array; clustering entries of the binary array; identifying outliers in the entries of the binary array; identifying an access control improvement based on the logical order of the entries, wherein the access control improvement is one of the following: privilege consolidation, or identification of an outlying privilege and a privileged subject; wherein the privilege consolidation comprises: identifying one of the clusters of entries, wherein the identified cluster indicates that a plurality of privileges have each been assigned to multiple subjects; identifying a role that can be assigned to the plurality of privileges. privilege consolidation, or identification of an outlying privilege and a privileged subject; wherein the privilege consolidation comprises: identifying one of the clusters of entries, wherein the identified cluster indicates that a plurality of privileges have each been assigned to multiple subjects; identifying a role that can be assigned to the plurality of privileges. identifying one of the clusters of entries, wherein the identified cluster indicates that a plurality of privileges have each been assigned to multiple subjects; identifying a role that can be assigned to the plurality of privileges.