Guide · Agent skill
How to use the Role Mining for RBAC Optimization agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the Role Mining for RBAC Optimization agent skill does, how to install it for Claude, and how to ask it for help with access data. It is written for identity and security teams who have an existing permission export and want to reduce the number of overlapping roles. After reading it, you will know how to install the skill, what inputs it needs, how to trigger it in plain language, and which checks to run before any role change goes live.
Role Mining for RBAC Optimizationmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 2Check Python. Confirm Python 3.9 or newer is installed with pandas, numpy and scikit-learn available.
- 3Export permissions. Obtain a CSV of user-permission or user-entitlement assignments from your identity governance platform or directory.
- 4Ask for a role mining run. Describe the goal in plain language and point the agent to your export file.
- 5Review the candidate roles. Check coverage, deviation and role count, and note which roles need correction.
- 6Validate with business owners. Have stakeholders approve or reject each proposed role before any enforcement.
What the skill makes the agent do
Role mining analyses who currently holds which permissions and proposes a smaller set of roles that describe real job functions. The skill teaches the agent bottom-up methods (finding patterns in existing grants, including clustering and formal concept analysis), top-down methods (designing roles from business requirements), and hybrid approaches that combine both.
The agent can also check how well proposed roles match actual access using coverage and deviation metrics, and it can run included Python scripts that load permission exports and generate candidate role definitions and migration plans.
- Clusters users with similar permission sets using k-means or hierarchical clustering
- Identifies exact permission sets shared by groups of users using formal concept analysis
- Reports role count, coverage, deviation and weighted structural complexity
Install the skill
Download the ZIP file for this skill from this page. Then choose one of the two install options below.
Option A: personal install for Claude Code. Unzip the file into ~/.claude/skills/ so the skill is available across your projects.
Option B: project install. Unzip the file into the .claude/skills/ folder inside a specific project so only that project uses it.
Option C: Claude apps. Upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Keep the folder structure intact: the skill is defined in SKILL.md and includes scripts/, references/ and assets/ folders
- Check that Python 3.9+ is available before running the scripts
Prepare your permission export
The skill needs a CSV export of user-permission or user-entitlement assignments. The reference file shows the expected layout with columns for user, entitlement and system. The skill does not pull data from your systems, so you need to obtain the export yourself through your identity governance platform or directory service.
The skill itself does not require credentials. Access to the identity platform is needed only to create the export.
- One row per assignment, for example user, entitlement, system
- Sources commonly include Active Directory, AWS IAM, Azure AD and individual applications, as listed in the project template
john.doe,read_files,FileServer
john.doe,write_files,FileServer
jane.smith,read_files,FileServerTrigger the skill with natural requests
You do not need special syntax. Describe the outcome you want and attach or point to your export. The agent should pick up the skill from its description, which covers role mining, RBAC role explosion, consolidating overlapping roles and least privilege.
Be specific about the goal and the data. Mention whether you want bottom-up discovery, a redesign from job functions, or a check of an existing role set.
- "Using my user_permissions.csv export, propose consolidated RBAC roles and report coverage and deviation."
- "We have thousands of overlapping roles. Mine candidate roles from this access data and explain the trade-offs."
- "Compare clustering and formal concept analysis on this permission export and tell me which gives fewer roles."
- "Draft a migration plan from current grants to the proposed roles for review by business owners."
Review the output and check the metrics
Mined roles reflect historical grants, which can include excess access. Treat every proposed role as a draft. The skill's metrics help you judge fit: coverage measures permissions explained by mined roles and the deviation measures extra permissions not covered by assigned roles. The reference targets listed are coverage above 95% and deviation below 5%, and the goal is to minimise role count and weighted structural complexity.
Use the included template to record results, the algorithm used, and stakeholder validation for each role.
- Coverage: permissions explained by mined roles divided by total permissions, target above 95%
- Deviation: extra permissions not covered by assigned roles, target below 5%
- Role count and weighted structural complexity: minimise
Safety notes: scripts and network
This skill runs scripts. Read the included scripts/process.py and scripts/agent.py before running them on production data, and run them first on a copy of the export. The skill's listing states it does not use the network, so it should not send your data elsewhere.
Do not enforce mined roles without validation. Business owners must review each role before any change is made, because the mined roles may preserve excess access.
- Run scripts on a copy of the export before using real data
- Do not apply role changes until business owners have reviewed them
- Remove sensitive exports from shared folders when the review is finished
What people use it for
- Reducing a large number of overlapping application roles to a smaller set of job-based roles
- Preparing an access review by comparing current grants with proposed roles
- Comparing clustering and formal concept analysis results on the same export
- Drafting a migration plan from individual grants to new roles for stakeholder sign-off
Frequently asked questions
How do I install the role mining agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need to use this skill?
You need Python 3.9 or newer with pandas, numpy and scikit-learn, plus a CSV export of user-permission assignments. The skill does not pull data itself, so you need identity governance platform or directory access to create the export.
Is the Role Mining for RBAC Optimization skill free?
The skill is listed under the Apache-2.0 licence. The source does not state any price, so check the licence file in the repository for the terms of use.
Does the skill connect to my identity system?
No. The skill works from a file you provide and is listed as not using the network. It does not need credentials, though you need access to your identity platform to produce the export.
What is the difference between bottom-up and top-down role mining?
Bottom-up mining finds common patterns in existing permissions, which suits large datasets with organic growth. Top-down mining designs roles from business requirements and job descriptions, which suits greenfield or restructuring projects. The skill also describes a hybrid approach.
Can I use this skill for general data clustering?
The skill is not intended for that. Its RBAC metrics and terminology, such as coverage and deviation, apply only to access-control data.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits identity and access management engineers and governance teams who have a permission export and want a structured, metric-driven starting point for role consolidation. It is less suitable for anyone who expects it to change live access on its own or who lacks an export. Every mined role still needs business owner review before enforcement.
Download the skill