> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/role-risk-factor.md).

# Role Risk Factor

### Overview

The **Role Risk Factor** is an aggregate risk signal computed per BalkanID Generated Role, derived directly from the role's confidence profile across all department, job title, and manager combinations. It is the inverse of role confidence at the generated-role level: roles with a high proportion of low-confidence mappings carry a higher risk factor.

This gives administrators a single, actionable signal per generated role to quickly identify which roles in their RBAC posture warrant attention, review, or remediation.

### How it is calculated

For each BalkanID Generated Role:

1. All role-confidence rows associated with that role are examined across every department, job title, and manager combination.
2. The percentage of rows that are **not** rated High confidence is computed.
3. That percentage is mapped to a risk bucket.

A role with all High-confidence rows receives a **Low** risk factor. As the share of non-High rows increases, the risk factor escalates toward **Very High**.

| Risk factor   | Color     | Reading                                                                                     |
| ------------- | --------- | ------------------------------------------------------------------------------------------- |
| **Low**       | 🟢 Green  | The role is uniformly high-confidence — its mappings align cleanly across cohorts.          |
| **Medium**    | 🟡 Yellow | A modest share of mappings are below High confidence.                                       |
| **High**      | 🟠 Orange | A large share of mappings are misaligned and should be reviewed.                            |
| **Very High** | 🔴 Red    | Most mappings are low-confidence — the role likely needs to be narrowed, split, or retired. |

### Role Risk Factor column

The BalkanID Generated Roles table — in both **Current State** and **Ideal State** RBAC views — includes a **Role Risk Factor** column displaying the computed risk bucket for each role, color-coded as above.

Clicking the risk factor badge for any role navigates directly to the Role Confidence table, pre-filtered to show only the confidence rows associated with that generated role. This lets administrators immediately inspect which department, job title, or manager combinations are driving the risk.

### Role Risk Factor dashboard chart

The main dashboard includes a **Current State RBAC Risk Factor** chart, automatically enabled when the RBAC module is active. This pie chart shows the distribution of all generated roles by risk factor bucket for a selected application.

**Usage:**

* Use the application dropdown selector to scope the chart to a specific integrated app.
* Each slice of the pie represents one risk bucket (Low, Medium, High, Very High).
* Clicking a slice navigates to the BalkanID Generated Roles table with filters applied for that application and the selected risk bucket, allowing for immediate drill-down and action.

{% hint style="info" %}
Risk factor data is point-in-time and does not include historical trendlines. To see whether your posture is improving, make changes in your IdP and re-run the analysis — the new run reflects the updated risk distribution.
{% endhint %}

### Using Role Risk Factor for remediation

1. Start with roles rated **Very High** or **High** and click through to the Role Confidence table to identify which department or job title combinations are misaligned.
2. Review whether the access represented by these roles reflects intentional provisioning or access drift over time.
3. Use the drill-down view to determine if the role should be **narrowed**, **split**, or **retired**.
4. After making adjustments to role assignments or RBAC policies in your IdP (such as Okta groups or Azure AD groups), re-run the RBAC analysis to monitor whether the risk factor improves.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.balkan.id/iam-risk-analyzer/rbac-analyzer/role-risk-factor.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.