So, essentially, I have a two-dimensional grid, and if the bit in the grid is 'on', access will be granted. Now, just for discussion, let's say I have 1000 users and 100 reports. That's up to a million different, individual access permsissions that may (or may not) have been granted.

I know for sure that there are some patterns in here. Alice, Bob, and Carlos all work in Accounts Receivable, so they might get the same few reports. Likewise, Rob, Sarah and Tom might have some reports in common.

Now, I don't know who works with who, I only know this grid of 100x1000. How can I mathematically figure out which 'sets' of reports can be assigned to people instead of individual user<->report rules so that I have some efficient groups and long-term administration becomes a bit easier?

This is my starting theory:

• for each user, find out how many other users have that same set of permisions
• add up how many individual permissions would be replaced by the new group
• store this group out, along with it's 'usefullness score'
• after all users, print the most 'useful' groups.

The major problem with that is this:

I might get 4 reports. If you're my boss, you might get my 4 plus 2 more. Logically, the four we have in common could be grouped, and you'd have two individuals in addition to the group of 4. My plan would miss that entirely, and I have a strong gut feeling that I'm ignorant of some nifty methodology for doing this kind of thing.

The only other thing I've thought of is doing some kind of ratio on how well any two users match. In the prior example, it would be a 4/6 or 67% match.

I just can't quite get my head around this. I studied accounting in school, and we pretty much stopped with addition and subtraction. <g> Grouping makes my brain hurt, but since this seems like a common need, I'd think this wheel should be laying around somewhere, just not in a form that I'm recognizing at the moment.