A single analysis tells you where you stand. Two or more tell you whether anything changed: which conflicts were resolved, which are new, which have not moved, and whether the trend is real or an artefact of a different scope. The comparison view answers that from the result files alone, without reloading any data source.
Typical uses:
- Remediation evidence: the same scope before and after a clean-up, with every resolved conflict listed
- A quarterly trend of conflicts per user, from the analyzed and at-risk counts of each run
- The impact of a ruleset change, by analyzing the same data with the old and the new version
- Re-testing a fix claimed during an audit, against a fresh export
Starting a comparison
- Go to Import Result
- Tick the checkbox of each analysis to compare
- Click Compare N selected
Between two and ten analyses can be compared at once, and they must all be of the same mode: user analyses with user analyses, role analyses with role analyses. The selection is ordered from oldest to most recent.
If the ticked analyses differ in ways that make the figures misleading, a Not directly comparable marker appears before you compare. Hover it to see why.
Baseline and statuses
Every status is computed between a baseline and the most recent analysis. The baseline is the oldest analysis by default and can be changed to any earlier one from the selector at the top of the Overview tab. The most recent analysis is always the comparison target.
Each pair of user (or role) and risk seen in any of the analyses gets one status:
| Status | Meaning |
|---|---|
| New | Absent from the baseline, present in the most recent analysis |
| Resolved | Present in the baseline, absent from the most recent analysis |
| Persisting | Present in both |
| Raised in between | Absent from both ends, but raised by an analysis in between. Shown only when it happens |
A conflict that keeps returning between quarters, for example through a role that is removed and reassigned, shows up as raised in between rather than disappearing from view.
The tabs
Overview
- Change since baseline: one tile per status with its count
- Risks across the analyses: a grouped bar chart of how many users (or roles) raise each risk, one bar per analysis
- Compared analyses: one row per analysis with its date, ruleset, data source, systems, simulation, the number of entities analyzed and at risk, the total of conflicts, the difference against the baseline, and the breakdown by risk level and risk type
The analyzed and at-risk counts are what a conflicts-per-user trend is built from: divide each run's conflicts by its users analyzed.
Risk delta
One row per pair of entity and risk, with its status and a column per analysis: x when the analysis raises it, - when it does not, and Removed when the analysis reported it but its simulation eliminates it.
Select a row to see the access behind it: the system, function, action, role or profile, authorization object, field and values, with the analyses in which each one was present. This is how you tell a conflict resolved by removing a role from one that moved to a different role.
By risk
One row per risk: how many entities raise it in each analysis, the difference against the baseline, how many entities are newly at risk and how many are no longer at risk. Sort by the difference to find the risks driving the change.
By user/role
One row per user or role: how many risks it raises in each analysis. Sort to find the accounts that improved most, or the ones that got worse.
Every table filters, sorts and exports to CSV like any other result table.
When analyses are not comparable
A comparison is only meaningful when the runs measure the same thing. The view checks this and shows a warning above every tab when:
| Warning | Why it matters |
|---|---|
| Different rulesets | Risk IDs may not mean the same thing |
| Same ruleset name, different checksum | The ruleset was edited between runs, so one risk ID may cover different permissions |
| Different data source or systems | Differences may only reflect the scope |
| Different criteria | For example other user types, user groups or risk levels; the differing values are listed |
| Only some runs are cross-system, include did-do, or include IAM business roles | Users or access are not counted the same way |
| Only some runs simulate something, or they simulate different things | A simulated result describes a hypothetical state, not the data source |
The comparison still runs. The warning is there so that a drop in conflicts caused by a narrower scope or a quietly edited ruleset cannot be presented as progress. For a ruleset review, a changed checksum is expected and the comparison is exactly the point: it lists every conflict the change added or removed.