PRIVILEGE GRAPH-BASED REPRESENTATION OF DATA ACCESS AUTHORIZATIONS

1 . A method for privilege graph-based representation of data access authorizations, the method comprising:

identifying first attributes of a first user;

performing a traversal of nodes in a privilege graph based on the first attributes, the traversal identifying a first subset of environments among a plurality of data environments, passing through at least one parent node that represents one or more privileges, and indicating that the first user has the one or more privileges with respect to the first subset of environments by passing through the at least one parent node before reaching the first subset of environments; and

presenting, to a querying user, a visual representation of a traversal path of the traversal through the privilege graph.

2 . The method of claim 1 , comprising:

identifying second attributes of a second user;

performing a second traversal of the nodes of the privilege graph based on the second attributes until one or more nodes representing a second subset of environments of the plurality of data environments is reached; and

presenting, to the querying user, a second visual representation of a second traversal path of the second traversal through the privilege graph.

3 . The method of claim 1 , wherein the querying user is an administrator authorized to view the privilege graph.

4 . The method of claim 1 , comprising:

receiving a search query from the querying user; and

performing the traversal in response to the search query.

5 . The method of claim 1 , comprising:

determining that the first user should have access to a first data environment that is not included in the first subset of environments;

identifying an attribute change to the first attributes that would allow the first user to access the first data environment; and

applying the attribute change to the first attributes.

6 . The method of claim 5 , comprising:

presenting the attribute change to an administrator; and

receiving confirmation that the attribute change should be applied, wherein applying the attribute change occurs in response to the confirmation.

7 . The method of claim 5 , comprising:

displaying the privilege graph to an administrator after the privilege graph is updated to reflect that the attribute change has been applied to the first attributes.

8 . The method of claim 1 , comprising:

receiving one or more alert parameters from the querying user, wherein the one or more alert parameters define an access event about which the querying user should be alerted; and

presenting an alert to the querying user in response to determining that the access event occurred.

9 . The method of claim 1 , comprising:

determining that an anomaly exists in the first subset of environments relative to other users having similar attributes to the first attributes; and

notifying an administrator about the anomaly.

10 . The method of claim 1 , comprising:

receiving a selection of a node in the privilege graph from the querying user; and

displaying additional detail related to the node in response to the selection.

11 . An apparatus comprising:

one or more computer readable storage media;

a processing system operatively coupled with the one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:

identify first attributes of a first user;

perform a traversal of nodes in a privilege graph based on the first attributes, the traversal identifying a first subset of environments among a plurality of data environments, passing through at least one parent node that represents one or more privileges, and indicating that the first user has the one or more privileges with respect to the first subset of environments by passing through the at least one parent node before reaching the first subset of environments; and

present, to a querying user, results of the traversal through the privilege graph.

12 . The apparatus of claim 11 , wherein the program instructions direct the processing system to:

identify second attributes of a second user;

perform a second traversal of the nodes of the privilege graph based on the second attributes until one or more nodes representing a second subset of environments of the plurality of data environments is reached; and

present, to the querying user, results of the second traversal through the privilege graph.

13 . The apparatus of claim 11 , wherein the querying user is an administrator authorized to view the privilege graph.

14 . The apparatus of claim 11 , wherein the program instructions direct the processing system to:

receive a search query from the querying user; and

perform the traversal in response to the search query.

15 . The apparatus of claim 11 , wherein the program instructions direct the processing system to:

determine that the first user should have access to a first data environment that is not included in the first subset of environments;

identify an attribute change to the first attributes that would allow the first user to access the first data environment; and

apply the attribute change to the first attributes.

16 . The apparatus of claim 15 , wherein the program instructions direct the processing system to:

present the attribute change to an administrator; and

receive confirmation that the attribute change should be applied, wherein applying the attribute change occurs in response to the confirmation.

17 . The apparatus of claim 15 , wherein the program instructions direct the processing system to:

display the privilege graph to an administrator after the privilege graph is updated to reflect that the attribute change has been applied to the first attributes.

18 . The apparatus of claim 11 , wherein the program instructions direct the processing system to:

receive one or more alert parameters from the querying user, wherein the one or more alert parameters define an access event about which the querying user should be alerted; and

present an alert to the querying user in response to determining that the access event occurred.

19 . The apparatus of claim 11 , wherein the program instructions direct the processing system to:

determine that an anomaly exists in the first subset of environments relative to other users having similar attributes to the first attributes; and

notify an administrator about the anomaly.

20 . One or more computer readable storage media having program instructions stored thereon that, when read and executed by a processing system, direct the processing system to:

identify first attributes of a first user;

traverse nodes in a privilege graph based on the first attributes, wherein traversal of the nodes identifies a first subset of environments among a plurality of data environments, passes through at least one parent node that represents one or more privileges, and indicates that the first user has the one or more privileges with respect to the first subset of environments by passing through the at least one parent node before reaching the first subset of environments; and

present, to a querying user, results of traversing the nodes.