Patent ID: 7761905

Claim:
A method for assigning to at least two subjects access rights to at least two objects in a computer system, said method comprising: identifying all access rights which have been granted to said each subject, wherein said all access rights have a respective level selected from ordered levels consisting of a read level, an update level, and an alter level, the read level being a lowest level of said all access rights, the alter level being a highest level of said all access rights, said all access rights including: an indirect access right that said each subject has on an object of said at least two objects by use of a respective existing role of at least one existing role, wherein said each subject is a member of the respective existing role, and wherein the respective existing role has an access right to said object, and a direct access right that said each subject has on another object of said at least two objects irrespective of said each subject's membership in said at least one existing role, wherein said each subject represents a respective user that manipulates a group of objects to which said each subject has said identified access rights within the computer system, and wherein the group of objects represents at least one data object corresponding to a respective resource of the computer system; after said identifying said all access rights, identifying, by a computer, at least one new role, said identifying said at least one new role comprising: analyzing a correlation selected from the group consisting of a subject-to-subject correlation and an object-to-object correlation, wherein the subject-to-subject correlation is defined as a first correlation comparing a first group of access rights granted to a first subject with a second group of access rights granted to a second subject, and wherein the object-to-object correlation is defined as a second correlation comparing a third group of access rights manipulating a first object with a fourth group of access rights manipulating a second object; and creating said at least one new role in accordance with a result from said analyzing; granting each role of said at least one new role access rights to each object of said at least two objects; assigning said each subject to a role of said at least one new role; and deleting said at least one existing role.