Computer analysis of software permissions for protecting access to data

A system for managing the scope of permissions granted by users to application comprising:

• an application description permission extractor for collecting a set of permissions for an application from an application provider publication;
• an application review process step extractor for collecting a process flow for functional steps of the application from a review of the application that is published on a product review type publication;
• a journey designator for dividing the functional steps of the application into a plurality of journeys, each of said plurality of journeys having a function associated with a stage of a functional step from a perspective of a user;
• a permission to journey matching permissions from the set of permissions for each journey of said plurality of journeys to provide matched permissible permissions to journeys stored in a customer journey store;
• and
• an application monitor for monitoring a running application for a user using the matched permissible permissions to the plurality of journeys stored in the customer journey store, wherein an execution of a permission by the running application that is not correlated to said matched permissible permissions in the customer journey store is designated as non-permissible to the user of the application.

A computer program product for managing the scope of permissions granted by users to an application, the computer program product comprising a computer readable storage medium having computer readable program code embodied therewith, the program instructions executable by a processor to cause the processor to:

• collect, using the processor, a set of permissions for an application from an application provider publication;
• collect, using the processor, a process flow for functional steps of the application from a review of the application that is published on a product review type publication;
• divide, using the processor, the functional steps of the application into a plurality of journeys, each of said plurality of journeys having a function associated with a stage of a functional step from a perspective of a user;
• match, using the processor, permissions from the set of permissions for each journey of said plurality of journeys to provide matched permissible permissions to journeys stored in a customer journey store;
• and
• monitor, using the processor, a running application for a user using the matched permissible permissions to the plurality of journeys stored in the customer journey store, wherein an execution of a permission by the running application that is not correlated to said matched permissible permissions in the customer journey store is designated as non-permissible to the user of the application.