> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/remediation-and-best-practices.md).

# Remediation & Best Practices

The RBAC Analyzer is most valuable when its findings become changes in your environment. This page describes how to turn the analysis into action and how to operate it as an ongoing program rather than a one-time audit.

### Recommendations and priority actions

Alongside the generated roles, the Analyzer emits **recommendations** — concrete suggestions for tightening access, and surfaces the most important ones as **Priority Actions**. Recommendations are ordered with **least privilege first**, so the changes that *reduce* access lead and the changes that *grant* access sit last.

Common recommendation types include:

| Action               | What it does                                                 | Direction      |
| -------------------- | ------------------------------------------------------------ | -------------- |
| **Revoke / Remove**  | Drop access that is redundant, unused, or over-provisioned.  | Reduces access |
| **Split**            | Break an over-broad role into tighter, more accurate roles.  | Reduces access |
| **Collapse / Merge** | Combine overlapping or duplicate roles into one.             | Reduces access |
| **Review**           | Flag access that needs a human decision before any change.   | Neutral        |
| **Grant**            | Close a gap where a cohort is missing access it should have. | Adds access    |

{% hint style="info" %}
Grant recommendations work *against* least privilege and the no-sprawl goal, so they are deliberately ranked last and clearly marked. Start with removals and reshapes; treat grants as the exception, not the default.
{% endhint %}

### A remediation workflow

A reliable loop for working the Analyzer:

1. **Prioritize by risk and readiness.** Start with roles rated **Very High** or **High** risk factor and with the access marked **High** risk band. Use Adoption Readiness to begin with roles that are **Ready**.
2. **Investigate before you act.** Open the role in the Permission Set Explorer to see exactly which identities, connections, and resources it touches. Confirm whether the access is intentional or drift.
3. **Decide the change.** Use the drill-downs to decide whether a role should be **narrowed, split, merged, or retired** — or whether an exception is justified and should be reviewed/attested instead.
4. **Apply it in your source systems.** The Analyzer is read-only; make the change in your IdP or application (for example, refine an Okta group or an Azure AD group) so it takes effect.
5. **Re-run and verify.** Re-run the RBAC analysis. Because the model is rebuilt from live data, confidence should rise, the risk factor should fall, and more roles should move into **Ready** if the change was right.

### Tackling the highest-leverage problems first

* **Terminated-but-active and dormant access** — clear these from the Risk Dashboard action items first; they are pure risk with little business cost to remove.
* **Over-provisioned identities** — identities accumulating far more group connections than their peers are prime candidates for right-sizing.
* **Redundant groups** — identical-access clusters and single-identity groups add review burden without adding value; consolidate or remove them.
* **Low-confidence, high-risk roles** — where a role is both misaligned and dangerous, it is the clearest candidate to split or retire.

### Operating it as a program

* **Move toward the ideal state incrementally.** You do not have to adopt the entire least-privilege target at once — work through it role by role, starting with the **Ready** tier.
* **Re-run on a regular cadence.** RBAC drifts continuously as people join, move, and leave. Re-running the analysis keeps the blueprint reconciled against how people actually work and prevents your IdP roles from going stale.
* **Track posture over time.** Use the posture grade, open-recommendation count, and readiness distribution as your scorecard. Improvement shows up as fewer high-risk roles and more access landing in the Ready tier with each run.

By closing the loop — analyze, prioritize, remediate in your source systems, and re-analyze — the RBAC Analyzer keeps your organization moving toward least privilege without disrupting day-to-day business.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/remediation-and-best-practices.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.