Topic starter
06/11/2026 6:38 pm
TL;DR: C1.ai describes Role Mining Suggestions as a way to identify groups worth converting into access profiles, using user count, shared entitlements and confidence scoring to speed role building and upkeep. The governance question is no longer whether access should be role-based, but how to stop role design from stalling in spreadsheet-led IGA.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “C1 Deploy: Role Mining Suggestions fast-track role building and upkeep”.
Key questions
Q: How do security teams turn entitlement data into reusable roles?
A: Security teams turn entitlement data into reusable roles by clustering common access patterns, then validating each cluster against business job function, data sensitivity and privilege level.
Q: How should teams stop role design from stalling in spreadsheets?
A: Teams stop role design stalling in spreadsheets by moving to a governed role engineering workflow with data-driven mining, role owners, approval gates and a controlled catalogue.
Q: What is the best way to keep access profiles current as teams change?
A: Teams keep access profiles current by tying them to HR events, application ownership and regular access reviews, then reconciling them when people change job, manager or location.
Practitioner guidance
- Build roles from recurring access patterns Use mined clusters of entitlements, job titles and team membership to create access profiles for groups that recur across the organisation rather than hand-coding each user’s access.
- Separate stable roles from exceptions Treat uncommon entitlements as exceptions to review, not as evidence that every access bundle needs its own role.
- Attach role changes to lifecycle events Update or revoke access when people move teams, change managers or leave, so the access model follows the current job context instead of the last approved ticket.
Bottom line: Role mining is most useful when it shortens the distance between observed access patterns and enforceable access profiles.
What's in the full announcement
C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step role mining workflow from suggestion list to access profile creation
- User interface actions for refreshing suggestions and reviewing confidence scores
- Lifecycle workflow examples showing how role changes propagate on moves and exits
- Operational examples of support team role design and upkeep across job changes
👉 Read C1.ai's post on role mining suggestions for access profile design →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Role mining is a design control, not just an optimisation feature. The governance value is that it reduces the time between observed access patterns and enforceable access profiles. When that gap stays wide, organisations keep operating with entitlement sprawl disguised as policy. The practitioner lesson is to treat role mining as part of access architecture, not as a reporting convenience.
A question worth separating out:
Q: What is the best way to keep access profiles current as teams change?
A: Teams keep access profiles current by tying them to HR events, application ownership and regular access reviews, then reconciling them when people change job, manager or location. Each profile should map to a role or entitlement set with a named owner, so mover events, temporary access and orphaned permissions are removed before they accumulate.
👉 Read our full editorial: Role mining turns access profile creation into a repeatable IAM task