Role discovery for identity and access management in a computing system

A system comprising:

• one or more processors;
• a data store storing access right data characterizing a plurality of access rights associated with a plurality of users of a computing system, wherein individual access rights of the plurality of access rights are associated with a particular computing device of the computing system;
• and
• memory storing instructions that, when executed by the one or more processors, cause the system to:
• obtain, from the data store, at least a portion of the access right data;
• generate, in accordance with a frequent pattern growth algorithm (FP-growth algorithm) and based on the portion of the access right data obtained, a tree data structure corresponding to the plurality of access rights;
• identify at least one candidate bundle of access rights at least by:
• traversing, in accordance with the FP-growth algorithm, the tree data structure;
• and
• applying at least one constraint during the traversing, wherein the at least one constraint excludes, from the at least one candidate bundle of access rights, at least one set of access rights represented in the tree data structure;
• perform, based on the portion of the access right data obtained, at least one evaluation of the at least one candidate bundle of access rights;
• select, at least based on the at least one evaluation, a candidate bundle of access rights of the at least one candidate bundle of access rights to define as a role;
• define, for the computing system, the role based on the candidate bundle of access rights selected;
• and
• provision the role for one or more users of the plurality of users, provisioning the role including revoking the individual access rights for the one or more users of the plurality of users and assigning the candidate bundle of access rights to the one or more users of the plurality of users.