> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/risk-dashboard.md).

# Risk Dashboard

## Risk Dashboard

The **Risk Dashboard** is the organization-wide, at-a-glance view of access risk that the RBAC Analyzer produces. Where the Permission Set Explorer is for tracing individual grants, the dashboard is for spotting concentrations of risk and hygiene problems across an integrated application — and clicking straight through to the people and access behind them.

The dashboard is scoped by an **application selector** at the top: pick an integrated app and every widget re-scopes to it.

### Posture overview

The dashboard opens with a posture summary — the headline metrics that tell whether the application's access is healthy: the overall posture grade, counts of active identities, and the key risk indicators that the rest of the dashboard breaks down. These are the same engine-derived signals summarized in the consolidation view.

### Action items

The **Action Items** section turns hygiene problems into a worklist. Each item is a clickable card that deep-links to the filtered list of identities behind it, so you can move from "we have a problem" to "here are the exact accounts" in one click. Typical action items include:

| Action item                     | What it surfaces                                                                   |
| ------------------------------- | ---------------------------------------------------------------------------------- |
| **Over-provisioned identities** | Active identities holding an unusually large number of group connections.          |
| **Identities with no access**   | Active identities that have no real access (often onboarding or offboarding gaps). |
| **Orphan identities**           | Active accounts belonging to terminated staff.                                     |
| **Dormant accounts**            | Active accounts that have not been used in a long time (e.g. 180+ days).           |
| **Never logged in**             | Provisioned accounts that have never been used.                                    |
| **Single-identity groups**      | Groups with only one member; candidates to collapse or remove.                     |
| **Groups with no identities**   | Empty groups that add noise and review burden.                                     |

### Analytics

The **Analytics** section visualizes the distribution of risk so outliers are easy to spot. The exact set of charts depends on the application and the data available, and commonly includes:

* **Group Distribution:** a histogram of how many group connections each active identity holds, with summary statistics (median, a high percentile, and the maximum) so you can see the typical footprint and the over-provisioned tail. The identities behind any band are one click away.
* **Login Dormancy** : how active identities distribute across last-access windows (e.g. 0–30, 30–90, 90–180, 180–365, 365+ days), surfacing standing access that is no longer used.
* **Identical Access Clusters**: sets of groups that grant exactly the same access, highlighting redundancy you can consolidate.
* **Active Risk Identities**: active identities carrying specific risk insights (e.g. terminated-but-active, over-entitled, unused access, separation-of-duties conflicts).
* **Current State RBAC Risk Factor**: the distribution of generated roles by risk bucket for the selected app. See Role Risk Factor.

Most charts are interactive: clicking a slice, bar, or band navigates to the filtered identities or roles behind it, so the dashboard is a starting point for action, not just a report.

{% hint style="info" %}
Dashboard data is point-in-time and does not include historical trendlines. To track improvement, remediate in your source systems and re-run the analysis — each run reflects the latest posture. 
{% endhint %}

### How to work the dashboard

1. Select the application you want to review.
2. Read the **posture overview** for the headline health of its access.
3. Clear the **action items** — start with terminated-but-active and over-provisioned identities, which carry the most risk.
4. Use the **analytics** charts to find concentrations — the dormant tail, redundant groups, high-risk roles — and click through to act.
5. Re-run the analysis after remediation to confirm the numbers move in the right direction.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/risk-dashboard.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.