Third-party access-control support using role history analysis

A non-transitory computer-readable medium having program code stored thereon, the program code executing by processing hardware to perform operations comprising:

• obtaining, via communications with contributor computing systems over a data network, role history data for entities;
• receiving, from a client computing system, a query requesting that an access-verification process be applied to an access request data structure having a set of credential elements for a target entity;
• preventing the client computing system from accessing additional role history data from an identity repository that does not match the query;
• retrieving, from the identity repository, a subset of the role history data for the target entity;
• correlating values between the set of credential elements of the access request data structure and attributes from the subset of the role history data;
• detecting, based on the correlation, an inconsistency between a first set of roles for the entity identified in the access request data structure and a second set of roles for the entity identified in the subset of the role history data;
• computing a role-occupancy assessment based on durations of the target entity in roles that are identified in the second set of roles;
• and
• transmitting a control signal to the client computing system, wherein the control signal is configured for causing the client computing system to present an interface having one or more of:
• the role-occupancy assessment with one or more visual indicators of a security assessment associated with the durations of the target entity in the roles, or a timeline view that visually depicts inconsistency data corresponding to the inconsistency.

A method that includes performing, by processing hardware, operations comprising:

• obtaining, via communications with contributor computing systems over a data network, role history data for entities;
• receiving, from a client computing system, a query requesting that an access-verification process be applied to an access request data structure having a set of credential elements for a target entity;
• retrieving, from an identity repository, a subset of the role history data for the target entity;
• detecting an inconsistency between a first set of roles for the entity identified in the access request data structure and a second set of roles for the entity identified in the subset of the role history data;
• computing a role-occupancy assessment based on durations of the target entity in roles that are identified in the second set of roles;
• generating a dynamic access-control data structure comprising (i) inconsistency data describing the inconsistency and (ii) the role-occupancy assessment;
• and
• transmitting a control signal having the dynamic access-control data structure to a device in the client computing system, wherein the control signal is configured for causing the device of the client computing system to present an interface having one or more of:
• the role-occupancy assessment with visual indicators of a security assessment associated with the durations of the target entity in the roles, or a timeline view that visually depicts the inconsistency data.