Anomaly detection for access control events

A computer program product, comprising:

• a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
• computer readable program code configured to receive a request for access to a protected resource originating from a computing device, the request for access is associated with a username;
• computer readable program code configured to acquire a baseline set of rules for the username derived from previous access requests associated with the username, the baseline set of rules comprises a set of locations;
• computer readable program code configured to acquire contextual information corresponding with the request for access, the contextual information comprises a location of the computing device;
• computer readable program code configured to detect a deviation from the baseline set of rules by detecting that the location is more than a threshold distance away from any location of the set of locations;
• computer readable program code configured to acquire authentication information in response to detecting the deviation;
• and
• computer readable program code configured to authorize access to the protected resource based on the authentication information.