RBAC Analyzer

The analyzer reads a role-based access control model: roles, the roles they inherit from, permissions, direct grants and separation-of-duty pairs. It detects inheritance cycles first, then expands effective permissions for every role and reports missing parent roles, duplicate or equivalent roles, redundant direct grants, roles without permissions, unused permissions and duty conflicts.

1. 1.Load an example, import a JSON or CSV file, or add roles and permissions in the Matrix tab.
2. 2.Toggle cells to grant or revoke direct permissions; inherited cells show where they come from.
3. 3.Edit inheritance in the Hierarchy tab or the JSON tab.
4. 4.Review Findings, open Effective permissions for a role, and export JSON, CSV, a Markdown matrix or a Mermaid diagram.

Deterministic findings follow from the model itself, such as a cycle or a role that holds both sides of a separation-of-duty pair. Heuristic findings are labelled Heuristic: broad roles above a coverage threshold, wildcard-like permission names, access-management permissions combined with sensitive ones, and many roles for few permissions. They are review hints, not statements about business intent.

Analysis runs in your browser and the model is not saved. The analyzer covers RBAC only: attribute, relationship or policy conditions are not evaluated, and a wildcard permission is not expanded into other permissions. Large models stay responsive by showing the matrix in pages of rows and a limited number of role columns.