Evaluating a result of enforcement of access control policies instead of enforcing the access control policies

A method comprising:

• detecting that an identified access control policy is created and set to an enforcement state in which the identified access control policy is to be enforced;
• providing a warning that recommends simulating enforcement of the identified access control policy with regard to an identified actual sign-in process instead of enforcing the identified access control policy with regard to the identified actual sign-in process;
• detecting that a state of the identified access control policy is changed from the enforcement state to a simulation state in which the enforcement of the identified access control policy with regard to the identified actual sign-in process is to be simulated;
• simulating enforcement of access control policies, including the identified access control policy, with regard to actual sign-in processes that are configured to sign-in users to a system instead of enforcing the access control policies with regard to the actual sign-in processes, the simulating comprising:
• monitoring access requests that are received during the actual sign-in processes, the access requests requesting access to a resource in the system;
• comparing attributes of the access requests against at least a subset of the access control policies that specifies criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the access requests;
• and
• generating metadata associated with the actual sign-in processes, which indicate whether the attributes of the access requests in at least a subset of the access requests satisfy the criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the access requests, instead of enforcing the access control policies with regard to the actual sign-in processes;
• and
• providing a recommendation, which recommends performance of an action, based at least in part on simulation of the enforcement of the access control policies with regard to the actual sign-in processes and based at least in part on the attributes of a specified access request not satisfying the criteria that are to be satisfied as the prerequisite to granting access to the resource to which access is requested by the specified access request.

A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:

• detecting that an identified access control policy is created and set to an enforcement state in which the identified access control policy is to be enforced;
• providing a warning that recommends simulating enforcement of the identified access control policy with regard to an identified actual sign-in process instead of enforcing the identified access control policy with regard to the identified actual sign-in process;
• detecting that a state of the identified access control policy is changed from the enforcement state to a simulation state in which the enforcement of the identified access control policy with regard to the identified actual sign-in process is to be simulated;
• simulating enforcement of access control policies, including the identified access control policy, with regard to actual sign-in processes that are configured to sign-in users to a system instead of enforcing the access control policies with regard to the actual sign-in processes, the simulating comprising:
• monitoring access requests that are received during the actual sign-in processes, the access requests requesting access to a resource in the system;
• comparing attributes of the access requests against at least a subset of the access control policies that specifies criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the access requests;
• and
• generating metadata associated with the actual sign-in processes, which indicate whether the attributes of the access requests in at least a subset of the access requests satisfy the criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the access requests, instead of enforcing the access control policies with regard to the actual sign-in processes;
• and
• providing a recommendation, which recommends performance of an action, based at least in part on simulation of the enforcement of the access control policies with regard to the actual sign-in processes and based at least in part on the attributes of a specified access request not satisfying the criteria that are to be satisfied as the prerequisite to granting access to the resource to which access is requested by the specified access request.