Specifying and Enforcing the Principle of Least Privilege in Role-Based Access Control
The role mining problem: finding a minimal descriptive set of roles