User role and authority management method, system and device and storage medium

Abstract

The invention relates to the technical field of computers, and discloses a user role and authority management method, system and device and a storage medium, and the method comprises the steps: accessing multi-source data, carrying out the preprocessing, and constructing a context snapshot; receiving request information, and analyzing a user intention; based on the context snapshot and the request context, reasoning, dynamic role affiliation judgment, authority demand assessment, risk assessment and decision suggestion output are carried out through a large model; the decision suggestion is converted into an executable technical instruction so as to dynamically adjust the user permission, the technical instruction comprises application program interface calling, configuration changing or strategy rule updating, and user permission adjusting comprises role distribution and permission granting or revocation; and in response to an execution result of the received technical instruction, a user behavior and an audit log, analyzing a decision effect, identifying a decision deviation, and optimizing the large model through a feedback learning mechanism. According to the invention, the flexibility, safety and efficiency of authority management can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computers, and in particular to a user role and permission management method, system, device and storage medium. BACKGROUND

[0002] At present, with the deepening of digital transformation, traditional business systems (such as ERP, CRM, OA, HRM, etc.) have become the core support of enterprise operation. These systems generally use Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC) models for user permission management. However, the traditional permission management model has the following significant defects:

[0003] Static and inflexible: Role definition and permission assignment are usually based on fixed organizational structure and job responsibilities, which is difficult to dynamically adapt to rapid changes in business processes, temporary project needs or cross-department collaboration scenarios. When the business adjusts, administrators need to manually modify a large number of role permissions, which is inefficient and prone to errors.

[0004] Coarse permission granularity, prone to misuse or deficiency: Traditional system permissions are usually divided into "function modules" or "data tables", with a coarse granularity. This leads to users being assigned "excessive permissions" (permission inflation) far beyond their actual work needs, increasing security risks; or being unable to complete work due to insufficient permissions, affecting efficiency.

[0005] Dependence on expert experience, complex configuration: The design and maintenance of the permission model highly depend on the business understanding ability of security administrators or IT experts, requiring in-depth knowledge of system functions and business logic, with a complex and time-consuming configuration process.

[0006] Weak context awareness: Traditional models are difficult to dynamically adjust permission decisions based on real-time context of user requests (such as time, location, device, operation purpose, current task flow), making it difficult to balance security and user experience.

[0007] Insufficient understanding of user intent: The system cannot understand the user's real business intent for performing an operation, and can only perform mechanical permission comparison, resulting in suboptimal decisions in complex or ambiguous scenarios.

[0008] Therefore, the present application provides a user role and permission management method to solve the above technical problems. SUMMARY

[0009] The application aims to provide a user role and permission management method, system, device and storage medium to solve the technical problem that the dynamic, fine and intelligent management of user roles and permissions cannot be achieved in the prior art.

[0010] To solve the above technical problems, the application provides a user role and permission management method, comprising:

[0011] In response to the accessed multi-source data and preprocessing, a context snapshot is constructed, wherein the context snapshot includes a user context snapshot, a business context snapshot and an environment context snapshot;

[0012] In response to the received request information containing a natural language description, a user intent is analyzed, wherein analyzing the user intent includes identifying an operation intent, extracting operation type, operation object and operation environment information, and forming a request context;

[0013] Based on the context snapshot and the request context, inference is performed through a large model, dynamic role attribution is determined, permission requirements are evaluated, risk assessment is performed, and decision suggestions are output, wherein the decision suggestions include allowing, rejecting, conditionally allowing or suggesting creating a new role;

[0014] The decision suggestions are converted into executable technical instructions to dynamically adjust user permissions, wherein the technical instructions include application program interface calls, configuration changes or policy rule updates, and adjusting user permissions includes role assignment, permission granting or revoking;

[0015] In response to the execution results of the received technical instructions, user behavior and audit logs, the decision effect is analyzed, the decision bias is identified, and the large model is optimized through a feedback learning mechanism.

[0016] In some embodiments, in response to the accessed multi-source data and preprocessing, a context snapshot is constructed, wherein the context snapshot includes a user context snapshot, a business context snapshot and an environment context snapshot, further comprising:

[0017] Accessing multi-source data, including user attributes, role definitions, permission settings, business logic and user behavior logs;

[0018] Preprocessing the multi-source data, including data cleaning, format conversion and data fusion;

[0019] Based on the preprocessed multi-source data, a user context snapshot dynamically reflecting user status, business processes and environmental factors is constructed, wherein the user context snapshot includes user attributes and status, the business context snapshot includes business processes and logic, and the environment context snapshot includes time, location and device information.

[0020] In some embodiments, in response to the received request information containing a natural language description, the user intent is parsed, wherein the parsing of the user intent includes identifying an operation intent, extracting an operation type, an operation object, and an operation environment information, forming a request context, and further comprising:

[0021] The operation type includes a function module access or a data operation, the operation object includes a data entity or a business object, and the operation environment includes a request time, a source device, and a network condition;

[0022] Receiving an operation request or a permission application containing a natural language description;

[0023] Extracting the user intent through semantic analysis and intent recognition, wherein the semantic analysis includes lexical analysis and syntax analysis, and the intent recognition determines the operation motivation based on pattern matching or a classification model;

[0024] Extracting the function module, the data object, the timestamp, and the device information involved in the operation, wherein the function module corresponds to a business system component, the data object includes a database record or a file, the timestamp indicates the request occurrence time, and the device information includes a terminal type and a network address;

[0025] Integrating the user intent and the operation context to form a structured request context, wherein the request context contains an intent label and a context attribute.

[0026] In some embodiments, based on the context snapshot and the request context, a large model is used for inference to determine dynamic role attribution, assess permission requirements, perform risk assessment, and output decision suggestions, wherein the decision suggestions include allowing, rejecting, conditionally allowing, or suggesting creating a new role, and further comprising:

[0027] Infer the dynamic role attribution based on the context snapshot and the request context, wherein the inference process considers user historical behavior, business demand, and environmental factors, and the dynamic role has temporary or conditional characteristics;

[0028] Assessing the function permissions, data permissions, and execution conditions required for the operation, wherein the function permissions control module access, the data permissions are refined to the field level, and the execution conditions include time limits or environmental constraints;

[0029] Analyzing security threats and compliance risks and generating a risk score, wherein the security threats include unauthorized access or data leakage, the compliance risks include policy violations, and the risk score is calculated based on threat level and probability;

[0030] Outputting decision suggestions containing operation authorization, permission adjustment, or role creation suggestions, wherein the operation authorization explicitly allows or rejects conditions, the permission adjustment suggestions involve permission expansion or reduction, and the role creation suggestions provide new role definitions and permission ranges.

[0031] In some embodiments, the decision suggestion is translated into executable technical instructions to dynamically adjust user permissions, wherein the technical instructions include application program interface calls, configuration changes, or policy rule updates, and adjusting user permissions includes role assignment, permission granting or revoking, further comprising:

[0032] The decision suggestion is translated into application program interface calls, configuration changes or policy rules, wherein the application program interface calls include permission management interfaces, the configuration changes modify role or permission settings, and the policy rules define access control logic;

[0033] The technical instructions are securely transmitted through encryption and authentication mechanisms;

[0034] The technical instructions are executed in real time to dynamically adjust permission or role settings, wherein the adjustments include permission granting, permission revoking or role assignment;

[0035] The execution results are returned and operation confirmations or exception prompts are provided, wherein the execution results include success status or error information, the operation confirmations require user verification, and the exception prompts include identifying execution problems and solution suggestions.

[0036] In some embodiments, in response to the execution results of the received technical instructions, user behavior and audit logs, the decision effectiveness is analyzed, the decision bias is identified, and the large model is optimized through a feedback learning mechanism, further comprising:

[0037] The execution results, operation behaviors and audit logs are collected to form a feedback dataset, wherein the execution results include permission change status and error reports, the operation behaviors record actual operations and feedback, and the audit logs include decision-making process and security events;

[0038] The decision accuracy is evaluated by comparing the expected decision and the actual behavior, wherein the evaluation includes permission matching degree, risk control rate and user satisfaction, and the actual behavior includes operation success or failure and security events;

[0039] The bias of over-allocated permissions, insufficient permissions or role misjudgment is identified, wherein over-allocated permissions indicate redundant permission granting, insufficient permissions reflect permission loss, and role misjudgment indicates role assignment error;

[0040] The large model parameters are optimized based on the feedback data using a learning algorithm, wherein the learning algorithm uses gradient descent or policy optimization, and the inference logic update includes rule adjustment or feature weight modification.

[0041] In some embodiments, it further includes a temporary permission management step:

[0042] Identify the permission requirements of temporary tasks, including project collaboration or emergency operations, including short-term access or specific functions;

[0043] Dynamically create temporary roles with permission scopes and validity periods, where the temporary role has a unique identifier, the permission scope is limited to task-related functions and data, and the validity period sets a time window;

[0044] Assign task-specific permissions to temporary roles, where the assignment process is automatically completed, permissions are activated synchronously with task start, and automatically expire after time limit;

[0045] Automatically revoke temporary roles and associated permissions after task completion, and restore the original state, where revocation is triggered based on task end events or time, and the original state refers to rolling back permission configuration to pre-task.

[0046] Based on the same concept, the present application also provides a user role and permission management system, comprising:

[0047] A context snapshot construction module configured to respond to multi-source data access and pre-processing, and to construct a context snapshot, wherein the context snapshot includes user context snapshot, business context snapshot and environment context snapshot;

[0048] A user intent analysis module configured to analyze user intent in response to received request information containing natural language description, wherein analyzing user intent includes identifying operation intent, extracting operation type, operation object and operation environment information, and forming request context;

[0049] An intelligent decision-making module configured to infer through a large model based on the context snapshot and request context, determine dynamic role attribution, assess permission requirements, and perform risk assessment, and output decision suggestions, wherein the decision suggestions include allowing, rejecting, conditionally allowing or suggesting creating a new role;

[0050] A permission policy generation and execution module configured to convert the decision suggestions into executable technical instructions to dynamically adjust user permissions, wherein the technical instructions include application program interface calls, configuration changes or policy rule updates, and adjusting user permissions includes role assignment, permission granting or revocation;

[0051] A feedback and optimization module configured to analyze decision effectiveness, identify decision bias, and optimize the large model through a feedback learning mechanism in response to received execution results of the technical instructions, user behavior and audit logs.

[0052] Based on the same concept, the application also provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus; the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the user role and permission management method.

[0053] Based on the same concept, the application also provides a computer readable storage medium storing a computer program executable by an electronic device, and when the computer program runs on the electronic device, the electronic device executes the steps of the user role and permission management method.

[0054] Compared with the prior art, it has the beneficial effects that:

[0055] The application discloses a user role and permission management method, system, device and storage medium, realizes the dynamic and intelligent of permission management, the traditional permission management model is based on static role and fixed permission allocation, and it is difficult to adapt to the rapidly changing business needs. The real-time inference ability of the large model can dynamically generate and adjust the user role and permission according to the business scene context, user behavior and operation intention, improve the flexibility and intelligent level of permission management.

[0056] The fine degree of permission management can be improved, and the traditional permission management is usually based on function modules or data tables as the granularity, which is easy to cause excessive or insufficient permissions. With the help of the deep understanding and inference ability of the large model, the application can refine the permission decision to the specific data field, operation type and execution condition level, and realize fine-grained permission control.

[0057] The system security and risk control ability can be enhanced, through the context perception and risk assessment ability of the large model, the application can analyze the security threats and compliance risks of user operation in real time, and dynamically adjust the permission decision. It can identify abnormal access patterns, potential unauthorized operations and other security threats, and take corresponding protection measures. At the same time, complete audit log and decision tracing mechanism ensures the transparency and auditability of all permission decision processes, enhances the security protection ability and compliance guarantee of the overall system.

[0058] The management complexity and operation and maintenance cost can be reduced, and the traditional permission management highly depends on the professional experience of security administrators, and the configuration process is complex and time-consuming. The application simplifies the permission configuration process through natural language interaction and intelligent recommendation, and the administrator can complete complex permission setting through an intuitive way. It can automatically recommend appropriate role and permission allocation scheme, reduce the dependence on expert experience, reduce the technical threshold and operation and maintenance cost of permission management, and improve the management efficiency.

[0059] The user experience and work efficiency can be improved, the user can obtain temporary permissions required to complete work more conveniently, and the waiting time and communication cost caused by insufficient permissions are reduced. The system provides accurate permission support by intelligently understanding the user's intention, so that the user can smoothly complete the work task, and the user satisfaction and work efficiency are improved. At the same time, the natural interaction mode reduces the learning cost of the user, and enhances the usability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0060] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments thereof, read in conjunction with the accompanying drawings:

[0061] Figure 1 is a flowchart of a user role and permission management method in some embodiments of the present application;

[0062] Figure 2 is a flowchart of a user role and permission management method in another embodiment of the present application;

[0063] Figure 3 is a flowchart of a user role and permission management method in another embodiment of the present application;

[0064] Figure 4 is a structural schematic diagram of a user role and permission management system in some embodiments of the present application;

[0065] Figure 5 is a structural schematic diagram of an electronic device in some embodiments of the present application;

[0066] In the figure, 710 is a processor; 720 is a memory; 730 is an input device; and 740 is an output device. DETAILED DESCRIPTION

[0067] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0068] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "an" and "the" used in the embodiments of the present application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. "Multiple" generally includes at least two.

[0069] It should be understood that the term "and / or" as used herein merely describes an associated relationship, that is, there can be three cases, such as A and / or B, which can represent the following three cases: A exists alone, A and B exist together, and B exists alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects.

[0070] It should be understood that although the terms first, second, third, etc. can be used in embodiments of the present application to describe, these descriptions should not be limited to these terms. These terms are only used to distinguish the description. For example, without departing from the scope of the embodiments of the present application, the first can also be called the second, and similarly, the second can also be called the first.

[0071] Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if it is determined" or "if (a stated condition or event) is detected" can be interpreted as "when it is determined" or "in response to determining" or "when (a stated condition or event) is detected" or "in response to detecting (a stated condition or event)".

[0072] It should also be noted that the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusion, so that a product or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such product or device. Without more limitations, the element defined by the sentence "including a" does not exclude the presence of another identical element in the product or device including the element.

[0073] In particular, it should be noted that the symbols and / or numbers present in the description, if not marked in the description of the drawings, are not drawing reference numbers.

[0074] Reference Figure 1 A user role and permission management method includes:

[0075] S101, in response to the accessed multi-source data and pre-processing, a context snapshot is constructed, wherein the context snapshot includes a user context snapshot, a business context snapshot and an environment context snapshot;

[0076] S102, in response to the received request information containing natural language description, the user intent is parsed, wherein parsing the user intent includes identifying the operation intent, extracting the operation type, operation object and operation environment information, and forming the request context;

[0077] S103, based on the context snapshot and the request context, performing inference by the large model to determine dynamic role attribution, assess permission requirements, perform risk assessment, and output decision suggestions, wherein the decision suggestions include allowing, rejecting, conditionally allowing, or suggesting creating a new role;

[0078] S104, converting the decision suggestions into executable technical instructions to dynamically adjust user permissions, wherein the technical instructions include application program interface calls, configuration changes, or policy rule updates, and adjusting user permissions includes role assignment, permission granting or revoking;

[0079] S105, in response to the execution results of the received technical instructions, user behavior and audit logs, analyzing decision effectiveness, identifying decision bias, and optimizing the large model through a feedback learning mechanism.

[0080] Specifically, in the embodiments of the present application, in response to the accessed multi-source data and pre-processing to construct the context snapshot, wherein the abnormal data is removed by data cleaning, the data standardization is realized by format conversion, the heterogeneous data sources are integrated by data fusion, the user context snapshot containing user attributes and state information, the business context snapshot containing business process and rule information, and the environment context snapshot containing time, place and equipment information are constructed respectively; in response to the received request information containing natural language description, the user intention analysis is performed, wherein the natural language semantics is understood by semantic analysis, the operation motivation is determined by intention recognition, and the operation characteristics are obtained by context extraction, so as to identify the operation intention, extract the function module access or data operation involved in the operation type, the data entity or business object involved in the operation object, and the request time and equipment information involved in the operation environment, and form the structured request context; based on the context snapshot and the request context, the inference is performed by the large model, the key context features are obtained by feature extraction, the matching degree of the user and the dynamic role is analyzed by role inference, the required permission granularity is determined by permission evaluation, and the security threat is evaluated by risk analysis, so as to judge the dynamic role attribution, evaluate the permission demand including function permission, data permission and execution condition, perform the risk evaluation including security threat analysis and compliance check, and output the decision suggestion including permission, rejection, conditional permission or suggestion to create a new role; the decision suggestion is converted into executable technical instructions, wherein the decision logic is converted into system instructions by instruction mapping, the standardization format is formed by instruction encapsulation, and the safe delivery is ensured by instruction transmission, and the specific technical instructions include application program interface calling to realize system interaction, configuration change to modify system settings, and policy rule updating to adjust control logic, so as to dynamically adjust the user permission, including assigning user roles by role allocation, granting operation permission by permission granting, and canceling existing permissions by permission revocation; in response to the execution result of the received technical instructions, the user behavior and audit log are analyzed and optimized, the expected and actual results are compared by effect evaluation, the decision problem is found out by deviation identification, the inference parameters are adjusted by model optimization, the decision effect including permission use compliance and role matching degree evaluation is analyzed, the decision deviation including permission over-allocation and role misjudgment is identified, and the large model parameters and inference logic are optimized by feedback learning mechanism including supervised learning and reinforcement learning.

[0081] For example, when a user submits a natural language request of "I need to view the sales data of this project for the third quarter for tomorrow's meeting preparation" through a mobile device, a context snapshot is constructed: the user context snapshot contains the user identity as a sales representative, and the current state is on duty; the business context snapshot contains that sales data access needs to be approved by the manager, and the third quarter data has been archived; the environmental context snapshot contains that the request time is 8 pm on weekdays, and the device is a personal mobile phone. Analyze the user's intention: identify the operation intention as data query, extract the operation type as data reading, the operation object as the third quarter sales data, and the operation environment as mobile access. The large model performs inference: based on the fact that the user is currently involved in the project, it is determined that he should belong to the dynamic role of temporary project member, and it is evaluated that read-only permission of sales data should be granted, the risk assessment shows low risk because the data is not sensitive and is used for official business, and the output is a conditional permission decision suggestion, that is, to grant 24-hour temporary access permission. Convert the decision suggestion into technical instructions: assign the temporary project member role through the user management interface, configure the data permission table to grant read-only permission of sales data, and update the policy rule to set a 24-hour validity period. Collect the execution results: the permission usage record shows that the user normally accesses the data within the time limit, the audit log has no abnormal operation, the analysis finds that the decision accuracy rate is 95%, and the large model weight is adjusted through feedback learning to improve the accuracy of temporary permission evaluation, where the supervised learning uses the gradient descent algorithm to optimize the model parameters with a loss function value decrease of 5% as the target, and the reinforcement learning adjusts the decision strategy with a permission usage satisfaction improvement of 10% as the reward signal.

[0082] In some applications, in response to accessing multi-source data and preprocessing, a context snapshot is constructed, wherein the context snapshot includes a user context snapshot, a business context snapshot, and an environmental context snapshot, including accessing multi-source data, including user attributes, role definitions, permission settings, business logic, and user behavior logs; preprocessing the multi-source data, including data cleaning, format conversion, and data fusion; based on the preprocessed multi-source data, a user context snapshot is constructed that dynamically reflects the user state, business process, and environmental factors, wherein the user context snapshot includes user attributes and state, the business context snapshot includes business process and logic, and the environmental context snapshot includes time, location, and device information.

[0083] It can be understood that, in response to the accessed multi-source data and preprocessing to build a context snapshot, wherein the multi-source data including position information and department information in user attributes, static role permissions and dynamic role templates in role definition, function access range and data operation permissions in permission settings, approval process and business rules in business logic, operation records and access history in user behavior logs are obtained in real time through a data access interface; preprocessing the multi-source data includes removing noise data through data cleaning using outlier detection and missing value processing techniques, achieving data structure uniformity through format conversion using standardized templates and coding rules, integrating heterogeneous data sources through association matching and entity resolution techniques; building a user context snapshot dynamically reflecting user state including login state and task progress, business process including current workflow state and business rule constraints, environmental factors including real-time timestamp and geographic location information based on preprocessed multi-source data, wherein the user context snapshot includes identity and post level in user attributes and activity indicators in state, the business context snapshot includes approval node state in business process and business policy conditions in logic, and the environmental context snapshot includes request time point and time period in time, network geographic location in place, and terminal type and device identifier in device information.

[0084] For example, the accessed multi-source data includes: user ID "U1001", position "sales manager", department "East China Sales Department" in user attributes; static role "sales manager" with customer data read-write permissions, dynamic role template "temporary project leader" with project full permissions in role definition; function access range including sales report module, data operation permissions including customer information table add, delete, modify and query in permission settings; three-level approval is required for sales contract approval, and the financial director needs to audit if the contract amount exceeds 100,000 yuan in business logic; the latest login time is "2024-09-05 08:30:00" and the number of customer data queries this month is 158 times in user behavior logs. Data preprocessing stage: after data cleaning, the proportion of valid data reaches 95%, and 3 abnormal transaction records are marked; in format conversion, different source time formats are unified to "YYYY-MM-DD HH:MM:SS" and department codes are unified to 6 digits; through user ID "U1001", the permission data and behavior data are associated to generate a complete user portrait. The constructed user context snapshot includes: position "sales manager" in user attributes, task completion rate 87% in state; the business context snapshot includes: there are 2 contracts to be approved in the current business process, and the contract amount threshold is set to 100,000 yuan in logic; the environmental context snapshot includes: request time "2024-09-05 14:30:00" in time, network IP belonging to "Shanghai City" in place, terminal type "PC terminal" and device identifier "MAC address xx:xx:xx:xx" in device information.

[0085] In some applications, in response to the received request information containing a natural language description, the user intent is parsed, wherein the user intent is parsed to identify the operation intent, extract the operation type, operation object and operation environment information, and form the request context, including the operation type including function module access or data operation, the operation object including data entity or business object, and the operation environment including request time, source device and network condition; receiving an operation request or permission application containing a natural language description; extracting the user intent through semantic analysis and intent recognition, wherein the semantic analysis includes lexical analysis and syntax analysis, and the intent recognition determines the operation motivation based on pattern matching or classification model; extracting the function module, data object, timestamp and device information involved in the operation, wherein the function module corresponds to the business system component, the data object includes database record or file, the timestamp indicates the request occurrence time, and the device information includes terminal type and network address; integrating the user intent and operation context to form a structured request context, wherein the request context contains intent label and context attribute.

[0086] It can be understood that, in response to the received request information containing a natural language description, the user intent is parsed, wherein the operation request or permission application containing a natural language description is received, the natural language is divided into lexical units through semantic analysis including lexical analysis, and the sentence structure relationship is analyzed through syntax analysis, the intent recognition determines the operation motivation based on pattern matching or classification model using machine learning algorithm, thereby extracting the user intent; the operation type includes function module access to call system function or data operation to perform add, delete, modify and query, the operation object includes data entity database table record or business object business process instance, and the operation environment includes request time timestamp information, source device terminal type and network condition network connection state; the function module corresponding to the business system component such as user management module is specifically extracted, the data object includes database record table data or file document, the timestamp indicates the request occurrence time accurate to seconds, and the device information includes terminal type mobile phone or computer and network address IP address; the user intent and operation context are integrated to form a structured request context through data association and attribute mapping, wherein the request context contains intent label operation classification identification and context attribute operation related parameter.

[0087] For example, a user submits a natural language request "Please help me export the sales report of last week for monthly summary". First, the operation request is received, and the sentence is segmented into lexical units such as "export", "sales report", and "last week" through semantic analysis. Syntax analysis analyzes the subject-predicate-object structure to determine the action object and time. Intent recognition classifies the operation motivation as a data export intent based on a classification model using a support vector machine algorithm, with a confidence of 92%. The operation type is extracted as the export function in data operations, and the operation object is the database table "sales_data" corresponding to the sales report data entity. The operation environment includes the request time "2024-09-05 14:30:00", the source device is a laptop, and the network condition is the company intranet IP address "192.168.1.100". Integrating user intent and operation context, the structured request context includes intent labels such as "data_export" and context attributes such as operation type "export", data object "sales_data", time range "2024-08-29 to 2024-09-04", device type "laptop", and network address "192.168.1.100". The time range is derived from the specific dates corresponding to last week through natural language processing, and the data object is mapped to the database table name through querying the metadata table.

[0088] In some applications, based on the context snapshot and request context, inference is performed through a large model to determine dynamic role attribution, assess permission requirements, conduct risk assessment, and output decision suggestions, which include allowing, rejecting, conditionally allowing, or suggesting creating a new role. The decision suggestions include inferring dynamic role attribution based on the context snapshot and request context, where the inference process considers user historical behavior, business requirements, and environmental factors. Dynamic roles have temporary or conditional characteristics. The required function permissions, data permissions, and execution conditions are evaluated, where function permission control modules access data permissions are refined to the field level, and execution conditions include time limits or environmental constraints. Security threats and compliance risks are analyzed and a risk score is generated, where security threats include unauthorized access or data leakage, and compliance risks include policy violations. The risk score is calculated based on threat levels and probabilities. Decision suggestions include operation authorization, permission adjustment, or role creation suggestions, where operation authorization explicitly allows or rejects conditions, permission adjustment suggestions involve permission expansion or reduction, and role creation suggestions provide new role definitions and permission ranges.

[0089] It can be understood that, based on the context snapshot and the request context, inference is performed by a large model, wherein based on the user state information, business process rules and environmental factor data in the context snapshot, and the operation intention label and operation environment attribute in the request context, the dynamic role attribution is inferred, considering the operation frequency statistics and pattern features in the user historical behavior, the task urgency and importance level in the business demand, the time sensitivity and device security in the environmental factor, the dynamic role has temporality such as short-term project role or conditionality such as event-triggered role; the function permission required for operation includes access control permission of system function module, data permission including read-write operation permission of database field level, execution condition including time limit such as access period and environmental constraint such as network location; analyze security threats including potential attempts of unauthorized access and possible ways of data leakage, compliance risks including violation of internal data policies or external regulatory requirements, generate risk score based on threat level division high, medium, low and occurrence probability percentage to calculate comprehensive score; output decision suggestions including operation authorization such as conditions explicitly allowing operation or reasons for refusing operation, permission adjustment suggestions such as expanding permissions to cover new needs or reducing permissions to follow the principle of least privilege, role creation suggestions such as providing new role name definition and associated permission range description.

[0090] For example, the user requests "modify the customer order status to handle returns", the context snapshot shows that the user has handled returns 20 times in the past 30 days in the user historical behavior, the current return rate is high and needs to be handled quickly in the business demand, and the working hours are 9:00-18:00 and the device is a company computer in the environmental factor; the request context shows that the operation intention is data update, the operation type is modification, and the operation object is the order status field. The large model infers the dynamic role attribution: based on the user's frequent handling of return business, it is judged that the temporary return handler role should be attributed, with a validity period of 30 days; evaluate the permission requirement: the function permission needs the write permission of the order management module, the data permission is limited to the modification of the order status field, and the execution condition is limited to working hours during working days; risk assessment: the security threat is medium, involving data modification, and the compliance risk is low, as it complies with the return policy, the risk score is calculated as 40 points (full score 100 points) by multiplying the threat level medium by the probability 20%; output decision suggestions: conditional permission, grant temporary role and limit to modify order status field only, and suggest monitoring operation logs to optimize subsequent decision-making.

[0091] In some applications, the decision suggestions are translated into executable technical instructions to dynamically adjust user permissions, where the technical instructions include application program interface calls, configuration changes, or policy rule updates, adjusting user permissions includes role assignment, permission granting or revoking, including translating decision suggestions into application program interface calls, configuration changes, or policy rules, where the application program interface calls include permission management interfaces, the configuration changes modify role or permission settings, and the policy rules define access control logic; the technical instructions are securely transmitted through encryption and authentication mechanisms; the technical instructions are executed in real-time to dynamically adjust permission or role settings, where the adjustments include permission granting, permission revoking, or role assignment; the execution results are returned and operation confirmations or exception prompts are provided, where the execution results include success status or error information, the operation confirmations require user verification, and the exception prompts include identifying execution problems and resolution suggestions.

[0092] It can be understood that the decision suggestions are translated into executable technical instructions to dynamically adjust user permissions, where the operation authorization conditions in the decision suggestions are translated into application program interface calls through instruction mapping logic to implement role assignment, the permission adjustment suggestions are translated into configuration changes to modify user role settings or permission scopes, and the role creation suggestions are translated into policy rule updates to define access control logic and conditional constraints; the technical instructions are securely transmitted through encryption mechanisms using transport layer security protocols and authentication mechanisms using digital certificates or token verification; the technical instructions are executed in real-time to dynamically adjust permission or role settings, where the adjustment operations include permission granting to add new operation permissions, permission revoking to remove existing permissions, and role assignment to associate users with specific roles; the execution results are returned and operation confirmations or exception prompts are provided, where the execution results include success status indicating that the operation is complete or error information describing the failure reason, the operation confirmations require users to verify permission changes through interactive interfaces, and the exception prompts include identifying execution problems such as resource conflicts or insufficient permissions and resolution suggestions such as retrying the operation or contacting an administrator.

[0093] For example, the decision suggestion is "conditionally allow user A to access project X data for 7 days", first convert the decision suggestion into technical instructions: application program interface call user management API interface "assignRole" to assign temporary role "project X viewer" to user ID "U1001", configure the permission table to grant read-only permission to the role for the data table "project_x_data", and update the policy rule to add the condition rule "valid period until 2024-09-12 23:59:59". The security transmission stage uses a TLS 1.3 encrypted channel and OAuth2.0 token authentication, and the transmission time is less than 200 milliseconds. Real-time execution of technical instructions: permission granting completes user role assignment and permission setting, the entire process is completed within 500 milliseconds; return the execution result success state "permission granted, valid period 7 days", operation confirmation requires the user to click the "confirm" button on the mobile terminal, and abnormal prompt such as when the user state is abnormal returns error code "ERR_403" and suggests "verify user account state and retry".

[0094] In some applications, in response to the received execution results of the technical instructions, user behavior and audit logs, analyze the decision effect, identify the decision bias, and optimize the large model through the feedback learning mechanism, including collecting execution results, operation behavior and audit logs to form a feedback data set, wherein the execution results include permission change status and error reports, operation behavior records actual operation and feedback, and audit logs include decision process and security events; compare the expected decision with the actual behavior to evaluate the decision accuracy, wherein the evaluation includes permission matching degree, risk control rate and user satisfaction, and the actual behavior includes operation success or failure and security events; identify the bias of over-allocated permissions, insufficient permissions or role misjudgment, wherein over-allocated permissions indicate redundant permission granting, insufficient permissions reflect permission loss, and role misjudgment indicates role allocation error; optimize the large model parameters based on the feedback data using learning algorithms, wherein the learning algorithm uses gradient descent or policy optimization, and the inference logic update includes rule adjustment or feature weight modification.

[0095] It can be understood that, in response to the execution result of the received technical instruction, user behavior and audit log, the decision effect is analyzed, wherein the feedback data set is formed by collecting the permission change success state in the execution result and the error report code, the actual permission use record in the operation behavior and the user feedback score, the decision timestamp in the audit log and the security event type; the decision accuracy is evaluated by comparing the permission allocation scheme in the expected decision with the operation success number and the security event occurrence number in the actual behavior, wherein the evaluation indexes include the permission matching degree which measures the consistency of allocated permissions and actually used permissions, the risk control rate which calculates the effective interception ratio of security threats, and the user satisfaction which is measured by the questionnaire score; the permission over-allocation such as granting unused function permissions, the permission deficiency such as lacking necessary operation permissions or the role misjudgment such as assigning mismatched business roles are identified, wherein the permission over-allocation is identified by permission use statistical analysis, the permission deficiency is identified by operation failure record, and the role misjudgment is identified by role and business matching degree analysis; the learning algorithm is used to optimize the large model parameters based on the feedback data, wherein the learning algorithm uses gradient descent to adjust the weight parameters or update the decision strategy with the goal of minimizing the loss function or maximizing the cumulative reward, and the inference logic update includes adjusting the threshold parameters in the permission evaluation rules or modifying the importance weights of the role inference features.

[0096] For example, the collected execution results are: 158 permission change success records and 12 error reports; the operation behavior is: the user actually uses 65% of the permissions, and the satisfaction score is 4.2 / 5.0; the audit log is: 200 decision records and 3 security events. The decision accuracy is evaluated: the permission matching degree is calculated as the coincidence degree of actually used permissions and allocated permissions reaches 85%, the risk control rate is the security event interception success rate of 93%, and the user satisfaction average score is 4.3; the decision bias is identified: 3 cases of permission over-allocation such as granting but not using the graph report function, 2 cases of permission deficiency such as lacking data export function, and 1 case of role misjudgment such as misjudging data analyst as data entry clerk. Based on these data, the gradient descent algorithm is used to optimize the model parameters with the goal of reducing the loss function from 0.15 to 0.12, the weight of the time-sensitive feature in the permission evaluation rules is adjusted from 0.6 to 0.8, and the role matching accuracy is improved from 88% to 92% through strategy optimization, wherein each model update iteration takes about 30 minutes, and the accuracy improvement amplitude is about 3-5%.

[0097] In some applications, temporary permission management steps are also included, identifying the permission requirements of temporary tasks, which include project collaboration or emergency operations, and the permission requirements include short-term access or specific functions; dynamically creating temporary roles with permission scope and validity period, where the temporary role has a unique identifier, the permission scope is limited to task-related functions and data, and the validity period sets a time window; assigning task-specific permissions to temporary roles, where the assignment process is automatically completed, the permissions are activated synchronously with the start of the task, and automatically expire after the time limit; automatically revoke temporary roles and associated permissions after the task is completed, and restore the original state, where revocation is triggered based on task end events or time, and the original state refers to rolling back the permission configuration to the pre-task state.

[0098] It can be understood that dynamic permission management is achieved by identifying the permission requirements of temporary tasks, which include cross-departmental cooperation tasks in project collaboration or system failure handling in emergency operations, and the permission requirements include short-term access such as temporary data query permissions or specific functions such as temporary approval permissions; dynamically creating temporary roles with permission scope and validity period, where the temporary role has a unique identifier to distinguish it from permanent roles, the permission scope is limited to task-related function modules and data objects, and the validity period sets a fixed time window or an elastic time interval; assigning task-specific permissions to temporary roles, where the assignment process is completed through an automated process without human intervention, the permissions are activated synchronously with the start time of the task, and the permissions are invalidated through an automatic trigger mechanism after the time limit expires; automatically revoke temporary roles and associated permissions after the task is completed, and restore the original state of the system, where the revocation operation is based on task end events such as project completion reports or time triggers such as reaching the preset validity period, and the original state refers to completely rolling back the permission configuration to the pre-task permission setting state.

[0099] For example, it is identified that the user needs to participate in the temporary task of "2024 Annual Audit Project", and the permission requirements include short-term access to financial data for 7 days and report export permissions in specific functions; dynamically create a temporary role "Audit 2024_Temporary Member" with a unique role ID "TEMP_ROLE_202409_001", the permission scope is limited to query functions of the finance module and read-only permissions of the audit data table, and the validity period is set from 08:00 on September 10, 2024 to 18:00 on September 17, 2024; automatically complete the permission assignment, activate all permissions at the start time of the project, and automatically expire after the end time; when the project is completed, the system automatically triggers the revocation process, removes the temporary role "Audit 2024_Temporary Member" and all associated permissions, and completely restores the user's permission configuration to the state before the project started, and the entire permission recovery process is completed within 5 seconds, ensuring timely recovery of the secure state.

[0100] The following will be combined Figure 2 and Figure 3Another embodiment of a user role and permission management method is illustrated:

[0101] As shown in Figure 2 and Figure 3 , this embodiment includes,

[0102] Data preparation and context construction: The multi-source data access and preprocessing module real-time converges and processes various data to build a complete context snapshot for the current scene. User request and intent analysis: When the user initiates an operation or permission application in the traditional business system, the request information (including natural language description) is sent to the device. The large model core reasoning engine analyzes the user intent and operation context. Intelligent decision-making: Based on the context snapshot and user request, the large model core reasoning engine calls its reasoning capability: judges the dynamic role to which the user currently belongs. Evaluate the permission requirements of the operation in the current context. Perform risk assessment. Output decision suggestions (allow, reject, conditionally allow, suggest creating a new role, etc.). Policy generation and execution: The permission policy generation and execution module converts the decision of the large model into specific technical instructions and issues them to the traditional business system through a secure interface, real-time adjusting user permissions or returning the decision result. Result feedback and closed-loop optimization: The system execution result, user behavior and audit log are fed back to the feedback learning and model optimization module. This module analyzes the decision effect, identifies the deviation, and is used for subsequent optimization of the large model to improve the accuracy and adaptability of its decision. The device also needs some information input to let the model understand the logic of data flow, such as the logic between personnel, roles, function lists, data ranges, the relationship between business, operation types, and review processes, etc. Moreover, the input of these information is much easier, more understandable, and simpler to operate than the configuration work of traditional business systems; when the logical relationship between data is established, subsequent changes in information, roles, personnel, business, etc. The large model can perform reasoning based on its knowledge reserve, derive execution strategies, and execute according to the strategies. At the same time, the strategy can also be output to the submitter for confirmation before execution to ensure the correctness of data flow. For some temporary work, temporary role creation and permission allocation can also be performed. With continuous feedback and optimization of the large model, it will be more flexible in user role and permission management, cover more business scenarios, and greatly save the management cost of system administrators.

[0103] For the method steps disclosed in the above embodiments, the method steps are described as a series of action combinations for the purpose of simple description, but those skilled in the art should know that the embodiments of the present application are not limited by the order of the described actions, because according to the embodiments of the present application, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of the present application.

[0104] As Figure 4 shown, the application also provides a user role and permission management system, comprising:

[0105] a context snapshot construction module 201 configured to respond to accessed multi-source data and pre-process, construct a context snapshot, wherein the context snapshot comprises a user context snapshot, a business context snapshot and an environment context snapshot;

[0106] a user intent analysis module 202 configured to respond to received request information containing natural language description, analyze user intent, wherein analyzing user intent includes identifying operation intent, extracting operation type, operation object and operation environment information, and forming request context;

[0107] an intelligent decision module 203 configured to infer through a large model based on the context snapshot and request context, judge dynamic role attribution, evaluate permission requirements, perform risk assessment, and output decision suggestions, wherein the decision suggestions include allowing, rejecting, conditionally allowing or suggesting creating a new role;

[0108] a generated and executed permission policy module 204 configured to convert the decision suggestions into executable technical instructions to dynamically adjust user permissions, wherein the technical instructions include application program interface calls, configuration changes or policy rule updates, and adjusting user permissions includes role assignment, permission granting or revoking;

[0109] a feedback and optimization module 205 configured to respond to received execution results of the technical instructions, user behavior and audit logs, analyze decision effectiveness, identify decision bias, and optimize the large model through a feedback learning mechanism.

[0110] It is worth noting that although only some basic functional modules are disclosed in the embodiments of the application, it does not mean that the composition of the system is limited to only the above basic functional modules. On the contrary, the meaning expressed in the embodiments is that on the basis of the above basic functional modules, those skilled in the art can add one or more functional modules to form an infinite number of embodiments or technical solutions in combination with existing technology, that is, the system is open rather than closed, and the protection scope of the claims of the application cannot be limited to the disclosed basic functional modules. At the same time, for the convenience of description, the above device is described as various units and modules. Of course, when implementing the application, the functions of the units and modules can be implemented in the same software and / or hardware.

[0111] As Figure 5As shown, the present application also provides an electronic device, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete the communication among each other through the communication bus; the memory stores a computer program, when the computer program is executed by the processor, the processor executes the steps of a user role and permission management method.

[0112] Figure 5 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. As shown in the structural diagram, the electronic device provided by the embodiment of the present application comprises one or more processors 710 and a memory 720; the processor 710 in the electronic device can be one or more, Figure 5 Figure 5 for example, one processor 710; the memory 720 is used for storing one or more programs; the one or more programs are executed by the one or more processors 710, so that the one or more processors 710 implement a user role and permission management method according to any one of the embodiments of the present application.

[0113] The electronic device can also comprise an input device 730 and an output device 740.

[0114] The processor 710, the memory 720, the input device 730 and the output device 740 in the electronic device can be connected through a bus or other means, Figure 5 for example, connected through a bus.

[0115] The memory 720 in the electronic device is a computer readable storage medium, which can be used to store one or more programs, and the program can be a software program, a computer executable program and a module, such as program instructions / modules corresponding to a user role and permission management method provided by the embodiment of the present application. The processor 710 executes various functional applications and data processing of the electronic device by running the software program, instruction and module stored in the memory 720, that is, implements a user role and permission management method in the above method embodiment.

[0116] ​The memory 720 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required by at least one function, and the like. The data storage area can store data created according to usage of the electronic device, and the like. Furthermore, the memory 720 can include a high-speed random access memory, and also can include a nonvolatile memory such as at least one of a magnetic disk storage device, a flash memory device, or other non-volatile solid state storage device. In some examples, the memory 720 can further include a memory remotely located with respect to the processor 710, which can be connected to the device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0117] The input device 730 can be used to receive input digital or character information, and to generate key signal input relating to user settings and function controls of the electronic device. The output device 740 can include a display device such as a display screen.

[0118] The present application also provides a computer readable storage medium storing a computer program executable by an electronic device, which when executed on the electronic device causes the electronic device to perform the steps of a user role and permission management method.

[0119] In particular, the computer storage medium of the embodiments of the present application can employ any combination of one or more computer readable media. The computer readable media can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this embodiment, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0120] Finally, it should be noted that the above-described embodiments are merely intended to illustrate the technical solutions of the present application, and not to limit the same; even though the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still make modifications to the technical solutions described in the foregoing embodiments, or make equivalent replacements to some or all of the technical features thereof; and such modifications or replacements do not cause the essence of the corresponding technical solutions to depart from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for managing user roles and permissions, characterized in that, include: In response to the accessed multi-source data and after preprocessing, a context snapshot is constructed, wherein the context snapshot includes a user context snapshot, a business context snapshot, and an environment context snapshot; In response to the received request information containing a natural language description, the user intent is parsed, wherein parsing the user intent includes identifying the operation intent, extracting the operation type, operation object and operation environment information, and forming a request context; Based on the aforementioned context snapshot and request context, reasoning is performed through a large model to determine dynamic role affiliation, assess permission requirements, conduct risk assessment, and output decision recommendations, including allowing, denying, conditionally allowing, or suggesting the creation of a new role. The decision recommendations are transformed into executable technical instructions to dynamically adjust user permissions. The technical instructions include application programming interface calls, configuration changes, or policy rule updates. Adjusting user permissions includes role assignment, permission granting, or revocation. In response to the execution results of the received technical instructions, user behavior, and audit logs, the system analyzes the decision-making effect, identifies decision-making biases, and optimizes the large model through a feedback learning mechanism.

2. The user role and permission management method according to claim 1, characterized in that, In response to the accessed multi-source data and after preprocessing, a context snapshot is constructed, wherein the context snapshot includes a user context snapshot, a business context snapshot, and an environment context snapshot, and further includes: Access data from multiple sources, including user attributes, role definitions, permission settings, business logic, and user behavior logs; Preprocessing of multi-source data includes data cleaning, format conversion, and data fusion; Based on preprocessed multi-source data, a user context snapshot is constructed that dynamically reflects user status, business processes, and environmental factors. The user context snapshot includes user attributes and status, the business context snapshot includes business processes and logic, and the environmental context snapshot includes time, location, and device information.

3. The user role and permission management method according to claim 1, characterized in that, In response to the received request information containing a natural language description, the user intent is parsed, wherein parsing the user intent includes identifying the operation intent, extracting the operation type, operation object, and operation environment information, forming a request context, and further includes: Operation types include functional module access or data operation; operation objects include data entities or business objects; and operation environments include request time, source device, and network conditions. Receive operation requests or permission requests that include natural language descriptions; User intent is extracted through semantic analysis and intent recognition. Semantic analysis includes lexical analysis and syntactic analysis, while intent recognition determines the motivation for the action based on pattern matching or classification models. The extraction operation involves functional modules, data objects, timestamps, and device information. Among them, functional modules correspond to business system components, data objects include database records or files, timestamps indicate the time when the request occurred, and device information includes terminal type and network address. User intent and operation context are integrated to form a structured request context, which includes intent tags and context attributes.

4. The user role and permission management method according to claim 1, characterized in that, Based on the aforementioned context snapshot and request context, reasoning is performed using a large model to determine dynamic role affiliation, assess permission requirements, conduct risk assessment, and output decision recommendations. These recommendations include allowing, denying, conditionally allowing, or suggesting the creation of a new role, and further include: Dynamic role attribution is based on context snapshots and request context reasoning. The reasoning process considers user history behavior, business needs and environmental factors. Dynamic roles have temporary or conditional characteristics. The assessment includes the functional permissions, data permissions, and execution conditions required for the operation. Functional permissions control module access, data permissions are refined to the field level, and execution conditions include time limits or environmental constraints. Analyze security threats and compliance risks and generate risk scores. Security threats include unauthorized access or data breaches, and compliance risks include policy violations. Risk scores are calculated based on threat level and probability. The output includes decision recommendations for operation authorization, permission adjustment, or role creation. Operation authorization explicitly allows or denies certain conditions, permission adjustment recommendations involve permission expansion or reduction, and role creation recommendations provide new role definitions and permission scopes.

5. The user role and permission management method according to claim 1, characterized in that, The decision recommendations are translated into executable technical instructions to dynamically adjust user permissions. These technical instructions include application programming interface (API) calls, configuration changes, or policy rule updates. Adjusting user permissions includes role assignment, permission granting, or revocation. Further, this includes: The decision recommendations are translated into application programming interface (API) calls, configuration changes, or policy rules. The API calls include permission management interfaces, configuration changes modify role or permission settings, and policy rules define access control logic. Technical instructions are transmitted securely through encryption and authentication mechanisms; Execute technical instructions in real time to dynamically adjust permission or role settings, including granting, revoking or assigning permissions; Return the execution result and provide operation confirmation or error message. The execution result includes a success status or error message. Operation confirmation requires user verification. Error message includes an indication of execution problems and suggested solutions.

6. The user role and permission management method according to claim 1, characterized in that, In response to the execution results of the received technical instructions, user behavior, and audit logs, the system analyzes the decision-making effect, identifies decision-making biases, and optimizes the large model through a feedback learning mechanism, further including: The execution results, operational behaviors, and audit logs are collected to form a feedback dataset. The execution results include permission change status and error reports, the operational behaviors record the actual operations and feedback, and the audit logs include the decision-making process and security events. The accuracy of decisions is evaluated by comparing expected decisions with actual behaviors. The evaluation includes permission matching degree, risk control rate and user satisfaction, while actual behaviors include whether the operation is successful or not and security incidents. It identifies deviations such as over-assignment of permissions, insufficient permissions, or misjudgment of roles. Over-assignment of permissions indicates granting unnecessary permissions, insufficient permissions reflect missing permissions, and misjudgment of roles indicates incorrect role assignment. Based on feedback data, a learning algorithm is used to optimize the parameters of a large model. The learning algorithm employs gradient descent or policy optimization, and the inference logic update includes rule adjustment or feature weight modification.

7. The user role and permission management method according to claim 1, characterized in that, It also includes temporary access control steps: Identify the permission requirements for temporary tasks, which include project collaboration or emergency operations, and permission requirements include short-term access or specific functions. Dynamically create temporary roles with permission scope and validity period. Each temporary role has a unique identifier, permission scope is limited to task-related functions and data, and validity period is set within a time window. Assign task-specific permissions to temporary roles. The assignment process is completed automatically, permission activation is synchronized with the start of the task, and permissions expire automatically after the time limit expires. After the task is completed, the temporary role and associated permissions will be automatically revoked and the original state will be restored. The revocation is triggered based on the task end event or time, and the original state means that the permission configuration is rolled back to before the task.

8. A user role and permission management system, characterized in that, include: The context snapshot building module is configured to respond to and preprocess the incoming multi-source data to build a context snapshot, wherein the context snapshot includes a user context snapshot, a business context snapshot, and an environment context snapshot; The user intent parsing module is configured to parse user intent in response to received request information containing natural language descriptions. Parsing user intent includes identifying operation intent, extracting operation type, operation object and operation environment information, and forming a request context. The intelligent decision-making module is configured to perform reasoning through a large model based on the context snapshot and request context, determine the dynamic role affiliation, assess permission requirements, conduct risk assessment, and output decision suggestions, wherein the decision suggestions include allow, deny, conditionally allow, or suggest creating a new role; The module for generating and executing permission policies is configured to transform the decision recommendations into executable technical instructions to dynamically adjust user permissions. The technical instructions include application programming interface calls, configuration changes, or policy rule updates. Adjusting user permissions includes role assignment, permission granting, or revocation. The feedback and optimization module is configured to respond to the execution results of the received technical instructions, user behavior, and audit logs, analyze the decision-making effect, identify decision-making biases, and optimize the large model through a feedback learning mechanism.

9. An electronic device, characterized in that, include: The system includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus; the memory stores a computer program, which, when executed by the processor, causes the processor to perform the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores a computer program executable by an electronic device, which, when run on the electronic device, causes the electronic device to perform the steps of the method according to any one of claims 1 to 7.

Images