An apparatus, comprising: a processor; and a memory operatively coupled to the processor, the processor configured to: identify at least one of: a software application installed on a client computing device (108a or 108b), or usage data, associated with a current user of the client computing device (108a or 108b) and for the software application; identify, based on the software application installed on the client computing device (108a or 108b) or the usage data, a user role (118b or 106b) for the current user of the client computing device (108a or 108b); predict, based on the user role (118B or 106B) for the current user of the client computing device (108a or 108b), an expected behavior of the current user of the client computing device; modify, at the client computing device (108a or 108b) and based on the expected behavior of the current user of the client computing device (108a or 108b), a privilege level for the current user of the client computing device (108a or 108b), the privilege level being associated with the software application; and send an identifier of the user role (118B or 106B) to an administrative server for storage in an Active Directory database. a processor; and a memory operatively coupled to the processor, the processor configured to: identify at least one of: a software application installed on a client computing device (108a or 108b), or usage data, associated with a current user of the client computing device (108a or 108b) and for the software application; identify, based on the software application installed on the client computing device (108a or 108b) or the usage data, a user role (118b or 106b) for the current user of the client computing device (108a or 108b); predict, based on the user role (118B or 106B) for the current user of the client computing device (108a or 108b), an expected behavior of the current user of the client computing device; modify, at the client computing device (108a or 108b) and based on the expected behavior of the current user of the client computing device (108a or 108b), a privilege level for the current user of the client computing device (108a or 108b), the privilege level being associated with the software application; and send an identifier of the user role (118B or 106B) to an administrative server for storage in an Active Directory database. identify at least one of: a software application installed on a client computing device (108a or 108b), or usage data, associated with a current user of the client computing device (108a or 108b) and for the software application; identify, based on the software application installed on the client computing device (108a or 108b) or the usage data, a user role (118b or 106b) for the current user of the client computing device (108a or 108b); predict, based on the user role (118B or 106B) for the current user of the client computing device (108a or 108b), an expected behavior of the current user of the client computing device; modify, at the client computing device (108a or 108b) and based on the expected behavior of the current user of the client computing device (108a or 108b), a privilege level for the current user of the client computing device (108a or 108b), the privilege level being associated with the software application; and send an identifier of the user role (118B or 106B) to an administrative server for storage in an Active Directory database.