# US 12,010,120 B2 · Computing system permission administration engine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,120 B2 - Document ID: US12010120B2 - Status: Granted - Kind: B2 - Application number: 17/812,977 - Filed: 2022-07-15 - Published: 2022-12-01 - Granted: 2024-06-11 - Earliest claimed: 2019-11-13 - Assignees: Salesforce, Inc. - Applicants: Salesforce, Inc. - Inventors: Freeman Parks; Ryan D. Woebkenberg - Web page: https://patentgrep.com/patent/US12010120B2 ## CPC - H04L 63/104: {Grouping of entities} - G06F 18/24: Classification techniques - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A plurality of permissions associated with the on-demand computing services environment may be identified. Each of the permissions may identify a respective one or more actions permitted to be performed within the on-demand computing services environment. Each of the permissions may be granted to a respective one or more user accounts within the on-demand computing services environment. A degree of overlap between a first group of the user accounts granted a first one of the permissions and a second group of the user accounts granted a second one of the permissions may be determined. When the degree of overlap exceeds a designated threshold, a designated permission set that includes the first permission and the second permission may be created. ## Claims ### Claim 1 A method implemented in an on-demand computing services environment, the method comprising: granting, to one or more user accounts, a first permission set including one or more permissions of a plurality of permissions associated with the on-demand computing services environment, each of the plurality of permissions corresponding to a respective one or more of a plurality of actions permitted to be performed by the on-demand computing services environment, wherein a machine learning classification procedure is used to generate the first permission set from the plurality of permissions associated with the on-demand computing services environment; monitoring use of the one or more permissions by the one or more user accounts; determining, based on the monitoring, one or more atypical permission set usages by the one or more user accounts; in response to the determining, identifying a designated permission set based, at least in part, on the determined atypical permission set usages; and recommending that the first permission set be updated to the designated permission set for the one or more user accounts. ### Claim 2 (depends on 1) The method of claim 1, wherein determining one or more atypical permission set usages comprises: determining at least one permission of the first set of permissions that is underutilized in comparison with a threshold. ### Claim 3 (depends on 2) The method of claim 2, wherein the designated permission set does not include the at least one underutilized permission. ### Claim 4 (depends on 1) The method of claim 1, wherein the designated atypical permission set does not include at least one permission used by other user accounts. ### Claim 5 (depends on 1) The method of claim 1, wherein the designated permission set includes at least one permission used by other user accounts. ### Claim 6 (depends on 1) The method of claim 1, wherein the designated permission set includes at least one permission of the first set of permissions. ### Claim 7 (depends on 1) The method of claim 1, wherein determining one or more atypical permission set usages by the one or more user accounts comprises: determining whether a level of utilization of an action associated with the first set of permissions falls below a threshold. ### Claim 8 A non-transitory computer-readable medium comprising computer-readable program code capable of being executed by one or more processors when, the program code comprising computer-readable instructions configurable to cause: granting, to one or more user accounts, a first permission set including one or more permissions of a plurality of permissions associated with the on-demand computing services environment, each of the plurality of permissions corresponding to a respective one or more of a plurality of actions permitted to be performed by the on-demand computing services environment, wherein a machine learning classification procedure is used to generate the first permission set from the plurality of permissions associated with the on-demand computing services environment; monitoring use of the one or more permissions by the one or more user accounts; determining, based on the monitoring, one or more atypical permission set usages by the one or more user accounts; in response to the determining, identifying a designated permission set based, at least in part, on the determined atypical permission set usages; and recommending that the first permission set be updated to the designated permission set for the one or more user accounts. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein determining one or more atypical permission set usages comprises: determining at least one permission of the first set of permissions that is underutilized in comparison with a threshold. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, wherein the designated permission set does not include the at least one underutilized permission. ### Claim 11 (depends on 8) The non-transitory computer-readable medium computer program product of claim 8, wherein the designated permission set does not include at least one permission used by other user accounts. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the designated permission set includes at least one permission used by other user accounts. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the designated permission set includes at least one permission of the first set of permissions. ### Claim 14 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein determining one or more atypical permission set usages by the one or more user accounts comprises: determining whether a level of utilization of an action associated with the first set of permissions falls below a threshold. ### Claim 15 A system comprising: a database system implemented using a server system, the database system configurable to cause: granting, to one or more user accounts, a first permission set including one or more permissions of a plurality of permissions associated with the on-demand computing services environment, each of the plurality of permissions corresponding to a respective one or more of a plurality of actions permitted to be performed by the on-demand computing services environment wherein a machine learning classification procedure is used to generate the first permission set from the plurality of permissions associated with the on-demand computing services environment; monitoring use of the one or more permissions by the one or more user accounts; determining, based on the monitoring, one or more atypical permission set usages by the one or more user accounts; in response to the determining, identifying a designated permission set based, at least in part, on the determined atypical permission set usages; and recommending that the first permission set be updated to the designated permission set for the one or more user accounts. ### Claim 16 (depends on 15) The system of claim 15, wherein determining one or more atypical permission set usages comprises: determining at least one permission of the first set of permissions that is underutilized in comparison with a threshold. ### Claim 17 (depends on 16) The system of claim 16, wherein the designated permission set does not include the at least one underutilized permission. ### Claim 18 (depends on 15) The system of claim 15, wherein the designated permission set does not include at least one permission used by other user accounts. ### Claim 19 (depends on 15) The system of claim 15, wherein the designated permission set includes at least one permission used by other user accounts. ### Claim 20 (depends on 15) The system of claim 15, wherein determining one or more atypical permission set usages by the one or more user accounts comprises: determining whether a level of utilization of an action associated with the first set of permissions falls below a threshold.