A method for determining access relationships on a host in a computerized system , the method comprising: collecting access-related configuration information from a plurality of entities provided by hosts in the computerized system, the configuration information comprising configuration information comprised in directories; determining access relationships between two or more entities based on the collected configuration information; storing, in a non-volatile storage , information about the determined access relationships, wherein the information identifies source entities and destination entities and the determined access relationships define user accounts associated with the source entities and authorized to log into user accounts associated with the destination entities; characterized by associating , by a first table, at least one host object representing the host with a directory filter object, wherein a directory filter represents a group of hosts that get the same set of user accounts from one or more directories, wherein the host belongs to said group of hosts, associating , by a second table, at least one object representing a user account with the directory filter object, wherein said user account belongs to the set of user accounts represented by the directory filter object, and determining which one or more user accounts exist on the host based on determining at least one directory filter object associated with a host object representing the host using the first table and determining at least one object representing a user account associated with the at least one directory filter objects using the second table, and determining which access relationships among said determined access relationships use said one or more determined user accounts as a destination entity or as a source entity, the determining comprising looking up access relationships whose destination entity or source entity indicates at least one user account object comprising an identifier identifying the user account. collecting access-related configuration information from a plurality of entities provided by hosts in the computerized system, the configuration information comprising configuration information comprised in directories; determining access relationships between two or more entities based on the collected configuration information; storing, in a non-volatile storage , information about the determined access relationships, wherein the information identifies source entities and destination entities and the determined access relationships define user accounts associated with the source entities and authorized to log into user accounts associated with the destination entities; characterized by associating , by a first table, at least one host object representing the host with a directory filter object, wherein a directory filter represents a group of hosts that get the same set of user accounts from one or more directories, wherein the host belongs to said group of hosts, associating , by a second table, at least one object representing a user account with the directory filter object, wherein said user account belongs to the set of user accounts represented by the directory filter object, and determining which one or more user accounts exist on the host based on determining at least one directory filter object associated with a host object representing the host using the first table and determining at least one object representing a user account associated with the at least one directory filter objects using the second table, and determining which access relationships among said determined access relationships use said one or more determined user accounts as a destination entity or as a source entity, the determining comprising looking up access relationships whose destination entity or source entity indicates at least one user account object comprising an identifier identifying the user account. <EOS>