Role Risk Factor

Overview

The Role Risk Factor is an aggregate risk signal computed per BalkanID Generated Role, derived directly from the role's confidence profile across all department, job title, and manager combinations. It is the inverse of role confidence at the generated-role level: roles with a high proportion of low-confidence mappings carry a higher risk factor.

This gives administrators a single, actionable signal per generated role to quickly identify which roles in their RBAC posture warrant attention, review, or remediation.

How it is calculated

For each BalkanID Generated Role:

1. All role-confidence rows associated with that role are examined across every department, job title, and manager combination.

2. The percentage of rows that are not rated High confidence is computed.

3. That percentage is mapped to a risk bucket.

A role with all High-confidence rows receives a Low risk factor. As the share of non-High rows increases, the risk factor escalates toward Very High.

Risk factor	Color	Reading
Low	🟢 Green	The role is uniformly high-confidence — its mappings align cleanly across cohorts.
Medium	🟡 Yellow	A modest share of mappings are below High confidence.
High	🟠 Orange	A large share of mappings are misaligned and should be reviewed.
Very High	🔴 Red	Most mappings are low-confidence — the role likely needs to be narrowed, split, or retired.

Role Risk Factor column

The BalkanID Generated Roles table — in both Current State and Ideal State RBAC views — includes a Role Risk Factor column displaying the computed risk bucket for each role, color-coded as above.

Clicking the risk factor badge for any role navigates directly to the Role Confidence table, pre-filtered to show only the confidence rows associated with that generated role. This lets administrators immediately inspect which department, job title, or manager combinations are driving the risk.

Role Risk Factor dashboard chart

The main dashboard includes a Current State RBAC Risk Factor chart, automatically enabled when the RBAC module is active. This pie chart shows the distribution of all generated roles by risk factor bucket for a selected application.

Usage:

• Use the application dropdown selector to scope the chart to a specific integrated app.

• Each slice of the pie represents one risk bucket (Low, Medium, High, Very High).

• Clicking a slice navigates to the BalkanID Generated Roles table with filters applied for that application and the selected risk bucket, allowing for immediate drill-down and action.

Risk factor data is point-in-time and does not include historical trendlines. To see whether your posture is improving, make changes in your IdP and re-run the analysis — the new run reflects the updated risk distribution.

Using Role Risk Factor for remediation

1. Start with roles rated Very High or High and click through to the Role Confidence table to identify which department or job title combinations are misaligned.

2. Review whether the access represented by these roles reflects intentional provisioning or access drift over time.

3. Use the drill-down view to determine if the role should be narrowed, split, or retired.

4. After making adjustments to role assignments or RBAC policies in your IdP (such as Okta groups or Azure AD groups), re-run the RBAC analysis to monitor whether the risk factor improves.