Systems and methods for system-wide granular access risk management

A system, comprising:

• a processor;
• a non-transitory computer-readable medium;
• and
• instructions stored on the non-transitory computer-readable medium and translatable by the processor for:
• generating a security extract metadata file from a system-specific security extract, the system-specific security extract specific to one of a plurality of enterprise-class systems in an enterprise computing environment, the security extract metadata file containing metadata describing security principals and associated permissions;
• generating a permissions metadata file from a rulebook, the rulebook specific to a system type and containing a rule and a plurality of business functions governed by the rule, each of the plurality of business functions having a set of permissions and a logical operator, the permissions metadata file containing metadata describing the rule and the plurality of business functions;
• analyzing the plurality of business functions as governed by the rule against the security principals and the associated permissions;
• determining hits that satisfy the set of permissions and the logical operator;
• and
• storing the hits in a database.

A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:

• generating a security extract metadata file from a system-specific security extract, the system-specific security extract specific to one of a plurality of enterprise-class systems in an enterprise computing environment, the security extract metadata file containing metadata describing security principals and associated permissions;
• generating a permissions metadata file from a rulebook, the rulebook specific to a system type and containing a rule and a plurality of business functions governed by the rule, each of the plurality of business functions having a set of permissions and a logical operator, the permissions metadata file containing metadata describing the rule and the plurality of business functions;
• analyzing the plurality of business functions as governed by the rule against the security principals and the associated permissions;
• determining hits that satisfy the set of permissions and the logical operator;
• and
• storing the hits in a database.