Simulation is not limited to changing what already exists. Roles and users that have never been created can be analyzed as if they were live, which moves the risk check ahead of the build instead of after it.
New Roles
The New Roles tab builds a role from scratch and analyzes it alongside real ones. It is available in both users analysis and roles analysis mode.
| Field | Meaning |
|---|---|
| Name | The name the role would have |
| Description | What the role is for |
| Authorizations | The permissions it would contain, defined object by object |
Authorizations use the same fields as any authorization change: permission object, permission field, and value from and to. See Role Simulation.
Roles created this way are marked as simulated, so results make clear which findings come from a proposed role rather than from the system.
Typical uses:
- Check a role design for built-in conflicts before it is created in PFCG
- Compare two candidate designs by simulating each and comparing the risks reported
- Test whether splitting an existing role into two actually removes the conflict, rather than moving it
New Users
The New Users tab adds users that do not exist yet. It is available in users analysis mode.
| Field | Meaning |
|---|---|
| Username | The user ID the person would have |
| Single roles | The single roles to assign |
| Composite roles | The composite roles to assign |
| Canonical name | Optional. Links the simulated user across systems so a cross-system analysis treats them as one person |
Typical uses:
- Check a joiner's intended role set for conflicts before the account is created
- Test a proposed standard role template for a job before it is rolled out to a population
- Check a mover scenario by simulating the target role set as a new user
The canonical name matters for cross-system work. Without it, the same simulated person in two systems is treated as two users, and a cross-system conflict between them will not be reported. See Running User Analysis for the cross-system setting.
Simulated roles and users can be combined. A new user can be assigned a new role, so an entire proposed design is testable before any of it exists.