> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer.md).
# RBAC Analyzer
The RBAC Analyzer is a unique capability provided by BalkanID that maps the current accesses within an organization to role buckets based on a combination of HRIS data (department, job titles, manager, etc.) and integrated application data (connections, resources, permissions, etc.). This analysis produces a blueprint that helps organizations understand their current **Role-Based Access Control (RBAC)** posture based on real-time data. Through this analysis, BalkanID's heuristics provide insights into how employees, their unique identities, and connections are grouped into BalkanID roles. These system-generated roles are further given unique, descriptive names to help users identify how and why these groups were created.
The **BalkanID Clustered Roles** do not actually exist in your systems; they are a virtual mapping that clusters how your existing connections (roles, groups, etc.), resources, and permissions can be grouped. You can use the BalkanID Generated Roles from the RBAC Analyzer to refine your IdP roles, such as Okta groups or Azure AD groups. This helps organizations keep their RBAC up to date at all times, which typically becomes stale over time if left unchecked.
Where most access reviews answer *"who has access to what,"* the RBAC Analyzer answers the harder questions: *"what should access look like,"* *"which roles are trustworthy,"* and *"where is the risk concentrated."* It does this by continuously re-deriving roles from live data, scoring every role and every grant, and surfacing a least-privilege target you can adopt without disrupting the business.
{% hint style="info" %}
The RBAC Analyzer is read-only by design. It never changes access in your source systems. It produces a blueprint and a set of recommendations that you apply in your own IdP or applications, then re-run the analysis to confirm the improvement.
{% endhint %}
### What the RBAC Analyzer gives you
* **Role creation:** roles are generated automatically from HR, IT, and usage data across all of your enterprise applications, without you having to hand-author a single group.
* **Confidence levels:** heuristics-driven confidence on every employee → identity → role/group/resource mapping help you define and audit your RBAC posture.
* **A data-driven approach:** advanced analytics provide the telemetry needed to proactively detect and remediate both security and compliance issues.
* **Risk-based remediation:** achieve least privilege and right-size permissions without disrupting business activities.
* **A least-privilege target**: alongside your *current* posture, BalkanID derives an *ideal* (least-privilege) state so you can see exactly what to keep, reshape, and remove.
### How the analysis is built
BalkanID combines a **bottom-up** and a **top-down** methodology to produce a robust RBAC model. The bottom-up pass studies what access actually exists and how it is used; the top-down pass studies how your organization is structured. The two are reconciled into BalkanID Generated Roles, each carrying a confidence profile, a risk factor, and a recommendation.
A deeper walkthrough of how roles are mined and how risk is scored lives in
[How It Works: Role Mining & Risk Analysis](/iam-risk-analyzer/rbac-analyzer/how-it-works-role-mining-and-risk-analysis.md).
### Where to go next
| If you want to… | Read |
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Understand the engine behind the analysis | [How It Works: Role Mining & Risk Analysis](/iam-risk-analyzer/rbac-analyzer/how-it-works-role-mining-and-risk-analysis.md) |
| Learn what the generated roles mean (birthrights) | [BalkanID Generated Role Clusters](/iam-risk-analyzer/rbac-analyzer/balkanid-generated-role-clusters.md) |
| Audit how trustworthy each role is |
|
| Compare today's access to a least-privilege target | [Current State & Ideal State RBAC](/iam-risk-analyzer/rbac-analyzer/current-and-ideal-state-rbac.md) |
| Drill into who holds which permission and why | [Permission Set Explorer](/iam-risk-analyzer/rbac-analyzer/permission-set-explorer.md) |
| See organization-wide access risk at a glance | [Risk Dashboard](/iam-risk-analyzer/rbac-analyzer/risk-dashboard.md) |
| Turn findings into action | [Remediation & Best Practices](/iam-risk-analyzer/rbac-analyzer/remediation-and-best-practices.md) |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.