Patent ID: 7284000

Claim:
A method of automatically generating a policy for a role, said role comprising a plurality of identities having attributes that include entitlements and non-entitlement attributes, comprising: automatically obtaining a list of attributes possessed by all of the identities in said role; automatically extracting from said list of attributes a first list of entitlements common to all of said predetermined number of the identities in said role; automatically forming a policy for said role that said first list of entitlements will be given to an identity subsequently added to said role; automatically extracting from said list of attributes a second list of entitlements not common to all identities in said role; automatically creating a vector, considering each identity associated with an entitlement in said second list, mapping the set of non-entitlement attributes possessed by said identity to the non-commonly-owned entitlements possessed by said identity; when a new identity having attributes is added to said role, automatically iterating through said vector to determine the identity whose non-entitlement attributes most closely match the non-entitlement attributes of said new identity; and automatically forming an additional policy for said role recommending that said new identity be given the entitlements of said most closely matching identity.