A computer-implemented method comprising: receiving, for each user characteristic of a plurality of user characteristics, first data (114; 116; 118; 214; 216; 218) that identifies one or more first actions that perform a first process and second data (114; 116; 118; 214; 216; 218) that identifies one or more second actions that perform a second process that is labeled as similar to the first process, wherein receiving the first data comprises receiving first screen capture data from a device performing the one or more first actions and generating the first data by performing computer vision techniques on the first screen capture data, the computer vision techniques performed on the first screen capture data including at least one of optical character recognition and image recognition, and wherein receiving the second data comprises receiving second screen capture data from a device performing the one or more second actions and generating the second data by performing computer vision techniques on the second screen capture data, the computer vision techniques performed on the second screen capture data including at least one of optical character recognition and image recognition, wherein a user characteristic identifies an operational role or an expertise level; training, using the first data for each user characteristic and using the second data for each user characteristic, a predictive model that is configured to classify actions as similar or not similar to the first process and the second process; receiving data that identifies actions performed by a user (130; 230); applying the predictive model to one or more of the actions; based on applying the predictive model to the one or more of the actions, classifying a process performed by the one or more actions as similar to a particular process that is associated with a particular user characteristic; associating the user with the particular user characteristic; and based on associating the user with the particular user characteristic, granting access to a system and granting or denying security permissions to the user. receiving, for each user characteristic of a plurality of user characteristics, first data (114; 116; 118; 214; 216; 218) that identifies one or more first actions that perform a first process and second data (114; 116; 118; 214; 216; 218) that identifies one or more second actions that perform a second process that is labeled as similar to the first process, wherein receiving the first data comprises receiving first screen capture data from a device performing the one or more first actions and generating the first data by performing computer vision techniques on the first screen capture data, the computer vision techniques performed on the first screen capture data including at least one of optical character recognition and image recognition, and wherein receiving the second data comprises receiving second screen capture data from a device performing the one or more second actions and generating the second data by performing computer vision techniques on the second screen capture data, the computer vision techniques performed on the second screen capture data including at least one of optical character recognition and image recognition, wherein a user characteristic identifies an operational role or an expertise level; training, using the first data for each user characteristic and using the second data for each user characteristic, a predictive model that is configured to classify actions as similar or not similar to the first process and the second process; receiving data that identifies actions performed by a user (130; 230); applying the predictive model to one or more of the actions; based on applying the predictive model to the one or more of the actions, classifying a process performed by the one or more actions as similar to a particular process that is associated with a particular user characteristic; associating the user with the particular user characteristic; and based on associating the user with the particular user characteristic, granting access to a system and granting or denying security permissions to the user.