> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/permission-set-explorer.md).

# Permission Set Explorer

<figure><img src="/files/fw9cMd3HYpWRscWlsa6h" alt=""><figcaption></figcaption></figure>

The **Permission Set Explorer** is the grant-level view of the RBAC Analyzer. Where the Generated Roles tables describe access in terms of *roles*, the explorer lets you trace access all the way down to *who holds which permission, on which resource, and through which connection* — for a single integrated application at a time.

It is the place to go when a number in a chart raises a question and you need to see the rows behind it.

### What it shows

The explorer pairs a visual flow with a precise, filterable table.

#### The access flow

At the top, a flow (Sankey) diagram reads left to right: **entities** (the resources and connections access is granted on) flow into the **privileges** granted on them. The thickness of each band reflects how many grants it represents, so the heaviest flows — and the most privileged actions, called out in red — stand out immediately. The diagram folds everything past the top handful of entities and privileges into a single "Other" band so it reads as a few clear flows rather than a hairball.

Clicking a privilege chip below the diagram filters the table to that privilege, turning the visual into a quick navigation control.

#### The grants table

Below the flow, a table lists each grant with the detail needed to act on it:

| Column                     | What it tells you                                                                                                                                                     |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Entity**                 | The resource or connection the access is on, with its type (e.g. Group, User, bucket) and kind (resource or connection). Links straight to that entity's detail page. |
| **Privilege**              | The specific permission granted (e.g. `read`, `member`, `admin`).                                                                                                     |
| **Identity**               | The person or service holding the access, with handle, name, type, and account status. Links to the identity's access page.                                           |
| **Access provider**        | The connection (group/role/policy) that confers the access, shown by name. Links to that connection's access page.                                                    |
| **Risk**                   | The grant's risk band — High, Medium, or Low.                                                                                                                         |
| **Last access**            | When the access was last used, where usage data is available — a key dormancy signal.                                                                                 |
| **Role**                   | The BalkanID Generated Role this grant rolls into, linking to the role's detail.                                                                                      |
| **Grade / Single-sourced** | The role's adoption grade and whether the permission is granted by exactly one role.                                                                                  |

Every composite cell deep-links to the relevant detail page, so the explorer is also a launchpad into the rest of the platform — from a grant you can jump to the entity, the identity, the connection, or the role behind it.

### States and stages

The explorer is scoped by two controls that mirror the rest of the Analyzer:

* **State: Current** or **Ideal**. Current shows access as it is today; Ideal shows the same access under the least-privilege target, so you can compare a permission set before and after consolidation.
* **Stage** is the grain you are looking at:
  * **Grants today:** the per-identity grants (who holds what).
  * **After Consolidation:** the role-level definitions (what each role grants), before and after consolidation.
  * **Single-sourced**: permissions granted by exactly one role.

Switching state and stage lets you answer questions like *"which of today's grants survive into the ideal state,"* or *"which permissions are over-granted by multiple roles."*

### Filtering and drill-down

* Use the **privilege chips** under the flow diagram as quick filters.
* Use the standard inline, deep-linked **filters** on the table (by entity, privilege, identity, risk band, and more) — filter state is captured in the URL, so a filtered view is shareable.
* **Sort** by any column, including risk, to bring the most concerning grants to the top.
* **Click through** any entity, identity, access provider, or role to land on its dedicated page with the right context pre-applied.

{% hint style="info" %}
The explorer and the dashboard charts read the same underlying analysis, so a count you click in a chart and the rows you see in the explorer describe the same access. If you ever need to reconcile a headline number, the explorer is the source of truth for the individual grants behind it.
{% endhint %}

### Typical uses

* **Investigate a risk spike:** sort by risk and inspect the High-band grants for an app.
* **Validate a recommendation**: before retiring a role, open it in the explorer to see exactly which identities and resources it touches.
* **Trace an over-provisioned identity**: filter to one identity and see every connection and resource feeding its access.
* **Confirm consolidation**: compare the same permission set in Current vs Ideal state to see what the least-privilege target removes.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/permission-set-explorer.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.