Permission Set Explorer

The Permission Set Explorer is the grant-level view of the RBAC Analyzer. Where the Generated Roles tables describe access in terms of roles, the explorer lets you trace access all the way down to who holds which permission, on which resource, and through which connection — for a single integrated application at a time.

It is the place to go when a number in a chart raises a question and you need to see the rows behind it.

What it shows

The explorer pairs a visual flow with a precise, filterable table.

The access flow

At the top, a flow (Sankey) diagram reads left to right: entities (the resources and connections access is granted on) flow into the privileges granted on them. The thickness of each band reflects how many grants it represents, so the heaviest flows — and the most privileged actions, called out in red — stand out immediately. The diagram folds everything past the top handful of entities and privileges into a single "Other" band so it reads as a few clear flows rather than a hairball.

Clicking a privilege chip below the diagram filters the table to that privilege, turning the visual into a quick navigation control.

The grants table

Below the flow, a table lists each grant with the detail needed to act on it:

Column	What it tells you
Entity	The resource or connection the access is on, with its type (e.g. Group, User, bucket) and kind (resource or connection). Links straight to that entity's detail page.
Privilege	The specific permission granted (e.g. read, member, admin).
Identity	The person or service holding the access, with handle, name, type, and account status. Links to the identity's access page.
Access provider	The connection (group/role/policy) that confers the access, shown by name. Links to that connection's access page.
Risk	The grant's risk band — High, Medium, or Low.
Last access	When the access was last used, where usage data is available — a key dormancy signal.
Role	The BalkanID Generated Role this grant rolls into, linking to the role's detail.
Grade / Single-sourced	The role's adoption grade and whether the permission is granted by exactly one role.

Every composite cell deep-links to the relevant detail page, so the explorer is also a launchpad into the rest of the platform — from a grant you can jump to the entity, the identity, the connection, or the role behind it.

States and stages

The explorer is scoped by two controls that mirror the rest of the Analyzer:

• State: Current or Ideal. Current shows access as it is today; Ideal shows the same access under the least-privilege target, so you can compare a permission set before and after consolidation.

• Stage is the grain you are looking at:

  • Grants today: the per-identity grants (who holds what).

  • After Consolidation: the role-level definitions (what each role grants), before and after consolidation.

  • Single-sourced: permissions granted by exactly one role.

Switching state and stage lets you answer questions like "which of today's grants survive into the ideal state," or "which permissions are over-granted by multiple roles."

Filtering and drill-down

• Use the privilege chips under the flow diagram as quick filters.

• Use the standard inline, deep-linked filters on the table (by entity, privilege, identity, risk band, and more) — filter state is captured in the URL, so a filtered view is shareable.

• Sort by any column, including risk, to bring the most concerning grants to the top.

• Click through any entity, identity, access provider, or role to land on its dedicated page with the right context pre-applied.

The explorer and the dashboard charts read the same underlying analysis, so a count you click in a chart and the rows you see in the explorer describe the same access. If you ever need to reconcile a headline number, the explorer is the source of truth for the individual grants behind it.

Typical uses

• Investigate a risk spike: sort by risk and inspect the High-band grants for an app.

• Validate a recommendation: before retiring a role, open it in the explorer to see exactly which identities and resources it touches.

• Trace an over-provisioned identity: filter to one identity and see every connection and resource feeding its access.

• Confirm consolidation: compare the same permission set in Current vs Ideal state to see what the least-privilege target removes.