01
Identity data
Fictional users or a validated CSV file processed in the browser.
Live interactive labPortfolio updated regularly
Enterprise identity security case study
AccessGraph AI
An explainable access-risk platform that maps fictional enterprise identities to roles, systems, and sensitive permissions so reviewers can detect conflicts and test least-privilege changes safely.
- Test identities
- 7
- Enterprise roles
- 12
- Risk controls
- 8 rule-based checks
- Import boundary
- 100 validated rows
My role
Product design, risk engine, frontend, AI integration
Technology
Next.jsTypeScriptCytoscape.jsOpenAI APICloudflare D1IAMSAP Security
The challenge
A real problem with practical constraints.
Enterprise permissions are difficult to review as flat role lists. A single identity can inherit access from several systems, and the dangerous combination may only appear when effective permissions are evaluated together. The project needed to make those relationships visible without relying on AI to invent security findings.
The response
A working system, not a slide deck.
I wrote a TypeScript rules engine for segregation-of-duties, privileged-access, stale-account, account-lifecycle, and role-accumulation checks. The interface connects every finding to its identity, role, system, and permission evidence, then lets an analyst add or remove temporary role assignments and review the resulting risk changes.
System design
How information moves through the project.
02
Risk engine
Effective permissions are evaluated against explicit conflict and lifecycle rules.
03
Evidence graph
Cytoscape renders identity-to-role-to-system-to-permission attack paths.
04
Analyst review
Reviewers test access, record decisions, export findings, and request plain-English AI explanations.
Engineering decisions
Choices that shaped the result.
These are the tradeoffs I would discuss in a technical interview.
Rules remain the source of truth
Every severity, score, and finding is created by testable application logic. AI receives only an existing finding and translates its evidence into plain language.
Imported identity data stays in the browser
CSV files are size-limited, schema-validated, capped at 100 rows, and analyzed locally instead of being uploaded to the explanation endpoint.
Simulation is reversible
Temporary role assignments are marked as test data and can be removed independently, allowing reviewers to compare risk before and after a change without altering the baseline scenario.
Security by design
- The AI endpoint validates the selected finding, applies database-backed rate limiting, and does not accept an arbitrary identity dataset.
- AI receives only the selected finding, response storage is disabled, and the project’s rules decide which findings exist.
- The demo contains no employee, customer, credential, or production-system information.
Outcome
- A recruiter or reviewer can inspect a complete IAM review process instead of reading a static project description.
- Attack paths expose why a conflict exists and which assigned role provides each sensitive permission.
- Finding statuses, notes, audit entries, CSV exports, and printable assessments show how an analyst could use the project.
Lessons learned
What I would carry into the next build.
LESSON 01
AI explanations are more useful when clear rules produce the evidence and the model is limited to explaining it.
LESSON 02
Reversible simulations make risk concepts easier to understand because reviewers can see the effect of one role change immediately.
LESSON 03
Clear limits on test data and file imports make the project safer and easier to understand.
Scope note
AccessGraph is an educational project built with fictional names and simplified checks. It is not an SAP-certified product, a compliance opinion, or a substitute for a formal enterprise access review.