Managing electronic information

An article of manufacture comprising:

• a machine-readable storage medium storing instructions configured to cause one or more machines to perform operations comprising:
• analyzing a plurality of database access statements that were issued for an application during the application's use to determine previous accessed items and types of access for the application;
• and
• developing a role for the application based on the previous accessed items and types of access for the application, wherein when the application is in use by a user, the developed role for the application allows the user database access.

A database security analyzer comprising:

• a communication interface configured to receive a plurality of database access statements that were issued for an application during the application's use;
• a memory configured to store the issued database access statements;
• and
• a processor configured to develop a role for the application based on the previously issued database access statements for the application, wherein when the application is in use by a user, the developed role for the application allows a user database access.

A method implemented by a computer comprising:

• capturing a plurality of database access statements that were issued for one or more applications during the application's use, wherein the database access statements comprise Structured Query Language (SQL) queries;
• normalizing the captured database access statements;
• eliminating redundancies in the normalized database access statements;
• analyzing the normalized database access statements stored in a computer memory to determine previous accessed items and types of access for an application, wherein the previous accessed items and types of access include objects accessed and operations performed on the objects;
• determining permissions for the application based on the previous accessed items and types of access for the application;
• developing a role for the application based on the determined permissions;
• determining which of a set of users are authorized to use the application;
• detecting a user request to establish a session of the application;
• determining if the user is authorized to use the application;
• if the user is authorized to use the application, finding the role for the application;
• assigning the role to the user;
• detecting an end of the application session;
• and
• if an end of the application session is detected, disabling the assigned role for the user.