Least-privilege resource permission management

A method, comprising:

• generating a graph representing permission assignments to resources of a tenant of a cloud service, the graph having nodes and edges, a node representing an identity, permission or resource, an edge representing an assignment of an identity with a permission to a resource or usage activity of a resource;
• computing a node embedding for each node representing an identity;
• utilizing the node embeddings to identify one or more similar identities to a first identity;
• and
• deriving a least-privilege permission for the first identity based on permissions used in resource usage history of the one or more similar identities.

A computing device, comprising:

• at least one processor and a memory;
• the at least one processor configured to:
• represent permissions assigned to an identity for a resource in a graph having nodes and edges, a node representing an identity, a permission or a resource, an edge representing an assignment of a permission to perform an action on a resource;
• overlay usage activity of each resource onto the graph;
• utilize an encoder to map paths through the graph into a node embedding for each identity node;
• determine similar identities in the graph to a first identity through differences in a node embedding of the first identity with node embeddings of other identities in the graph;
• and
• generate a least-privilege permission for the first identity based on a predicted future resource usage of the first identity, the predicted future resource usage based on resource usage history of the similar identities.