Skip to content
Get packs

Role Mining for RBAC Optimization

Analyze user permission data to consolidate overlapping access roles and enforce least privilege

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill teaches an AI agent how to study who has which access permissions in a company's systems and propose a smaller, cleaner set of job-based roles to replace the tangle of individual grants that builds up over time. It explains and applies clustering, formal concept analysis and related methods, plus coverage and deviation metrics to check how well the proposed roles match actual access. The agent can also run included Python scripts that load permission exports and generate candidate role definitions and migration plans.

Great for

  • Identity and access management engineers reducing role explosion in an existing RBAC system
  • Security or governance teams preparing an access review or role redesign from exported permission data
  • Analysts who want a worked example of role mining methods applied to access data

Skip it if

  • Production role changes made without validation: mined roles reflect historical grants, which may include excess access, so business owners must review them before any enforcement
  • Environments without a permission export or identity platform access, since the skill cannot pull live data on its own
  • Non-security uses such as general data clustering, where the RBAC metrics and terminology would not apply

Try asking

  • “Here is a CSV of user_id and permission_id pairs from our directory; find candidate roles that cover at least 95% of assignments.”
  • “Help me reduce our role count by consolidating overlapping roles and report the deviation from current access.”
  • “Run role mining on our entitlement export and draft a migration plan for the proposed roles.”
  • “Explain the difference between bottom-up and top-down role mining for our RBAC redesign.”
Step-by-step guide: how to use Role Mining for RBAC OptimizationInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    building-role-mining-for-rbac-optimization.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-role-mining-for-rbac-optimization.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-role-mining-for-rbac-optimization.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Start with a sanitized or anonymized export and review the scripts before running them on sensitive identity data.
  • Treat mined roles as proposals and validate them in workshops with business stakeholders before changing access.
  • Check the coverage and deviation metrics, and watch for clustering results that grant broad permissions to small groups.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.