Generation of a privilege graph to represent data access authorizations

An apparatus comprising:

• one or more computer readable storage media;
• a processing system operatively coupled with the one or more computer readable storage media;
• and
• program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
• extract identity information for a plurality of users from a plurality of identity environments and privilege information from a plurality of data environments;
• form subgraphs for the identity environments and the data environments from the identity information and the privilege information;
• translate the subgraphs into a canonical schema;
• and
• after translating the subgraphs, combine the subgraphs into a privilege graph.

One or more computer readable storage media having program instructions stored thereon that, when read and executed by a processing system, direct the processing system to:

• extract identity information for a plurality of users from a plurality of identity environments and privilege information from a plurality of data environments;
• form subgraphs for the identity environments and the data environments from the identity information and the privilege information;
• translate the subgraphs into a canonical schema;
• and
• after translating the subgraphs, combine the subgraphs into a privilege graph.