Privilege creep is accumulation without review: each membership was justified once, none were removed, and the sum exceeds every role the person has actually held. It is invisible person by person and obvious in aggregate, which is why detection is a measurement problem.
The structural signals#
Creep shows up in comparisons, not in individual records:
- Peer outliers: users whose membership count or reach far exceeds teammates in the same role.
- Supersets: users whose memberships strictly contain a colleague's, the extra being the creep candidate.
- Tenure correlation: membership counts that grow with years of service is the signature of never-removed access.
- Cross-boundary reach: individuals whose transitive membership spans departments their role does not.
From detection to reduction#
Detection produces candidates, not verdicts: each flagged membership still needs the is-it-required conversation with the role's owner. What detection changes is where that conversation spends its time, on the outliers instead of uniformly across everyone.
VisualizerEngine
How VisualizerEngine helps
Structural search expresses the signals as queries, membership counts, supersets, and cross-hierarchy reach, and the graph shows each candidate's actual paths for the review conversation. What-if simulation previews removals so reduction proceeds without breakage, and snapshots measure whether creep is shrinking quarter over quarter.