Techniques for reconciling permission usage with security policy for policy optimization and monitoring continuous compliance

An article of manufacture for managing a security policy having multiple policy items, comprising a non-transitory machine-readable medium containing one or more programs which when executed implement the steps of:

• (a) mapping permissions to the policy items which apply to usage of the permissions so as to determine which of the permissions are granted to groups of users by each of the policy items;
• (b) identifying at least one of the policy items mapped in step (a) that is in violation of least privilege based on a comparison of an actual permission usage with the security policy, wherein least privilege specifies that the users are only given privileges that are needed to execute their functions;
• (c) identifying at least one of the policy items mapped in step (a) that increases operational risk;
• (d) verifying that policy constructs in the security policy are consistent with constructs that are inferred from the actual permission usage;
• and
• (e) identifying optimizations of the security policy based on output from one or more of steps (a)-(d).