Patent ID: 7904556

Claim:
Computer apparatus configured to discover roles from structure existing amongst users to whom resources have been assigned, the apparatus comprising: a processor, a discovery unit, operable via said processor, configured for searching for patterns within links between users and resources partitioned into a set of nodes of users and a set of nodes of resources, wherein: each user of said set of nodes of users comprises a node with an assignment of resources from the set of nodes of resources, and the links comprise said assignments between respective users and resources, a grouping unit, associated with said discovery unit, configured to use said discovered patterns to form at least one group from said user nodes using said discovered patterns, such that: users having all or a subset of at least two links to common resources are automatically determined to be placed into a same group, and the users of the at least one group did not exist as a group prior to the discovery unit searching for patterns within the links, and an output unit configured for outputting said at least one group of users or resources as a role.