Role authority management method, device and storage medium for multi-organization business system

Abstract

This application relates to the field of authority management technology, and specifically discloses a role authority management method, device, and storage medium for a multi-organization business system, wherein the method includes: establishing a system role group for each functional position, using the functional position as the minimum authorization unit to authorize users; constructing an account authority audit model, auditing user permissions, and obtaining audit results; and verifying and feeding back the audit results to reversely optimize the position role group. This is to address the problem that the role-based authorization model in the existing technology is no longer able to fit the complex and changing organizational regional structure and business scenarios, resulting in various account authority management issues and posing security risks to the business development of the enterprise.

Description

Technical Field

[0001] The present application relates to the technical field of authority management, and in particular to a method, device and storage medium for role authority management of a multi-organization business system. Background Art

[0002] As digital human resource assessments and regional account management continue to strengthen, system permission management faces a dual challenge. On the one hand, the number of business systems continues to grow, bringing with it a surge in role permissions and complex interrelationships. On the other hand, management requirements for data security and permission security are also increasing, requiring enterprises to adopt more stringent and sophisticated measures to address them.

[0003] The existing role-based authorization model is no longer able to adapt to the complex and ever-changing organizational regional structure and business scenarios, resulting in various account permission management issues and posing security risks to corporate operations and development. Summary of the Invention

[0004] The purpose of this application is to provide a role authority management method, device and storage medium for a multi-organization business system to solve the problem that the role-based authorization model in the existing technology can no longer adapt to the complex and changeable organizational regional structure and business scenarios, resulting in various account authority management problems and posing security risks to the business development of the enterprise.

[0005] To achieve the above objectives, this application provides a role authority management method for a multi-organization business system, including:

[0006] Establish a system role group for each functional position, and use the functional position as the minimum authorization unit to authorize users;

[0007] Build an account permission audit model, audit user permissions, and obtain audit results;

[0008] The audit results are verified and feedback is provided to reversely optimize the job role groups.

[0009] Optionally, establishing a system role group for each functional position and authorizing users using the functional position as the minimum authorization unit specifically includes:

[0010] Obtain the personnel composition, benchmark position configuration, and division of responsibilities for each region and department, break down the benchmark positions into specific functions, obtain the corresponding functional positions, and output the relationship between the benchmark positions and the functional positions;

[0011] Based on the principle of minimizing the permissions required to complete the specific functions, sort out the business system role groups corresponding to the functional positions;

[0012] Based on actual application scenarios, obtain position management, query, display, and permission configuration functions based on benchmark position authorization.

[0013] Optionally, the building of an account authority audit model, auditing user authority, and obtaining audit results specifically includes:

[0014] Obtain the user's organizational level, department, and actual role list in each system, and compare and audit the role permissions of the user's benchmark position to determine whether the user has exceeded their permissions and the type of violation.

[0015] Three warning levels are divided according to the types of overstepping authority;

[0016] Output audit results based on personnel and position dimensions, and rectify personnel and positions that exceed their authority.

[0017] Optionally, the types of unauthorized access include:

[0018] Functional position exceeding authority: The actual system role exceeds the scope of the system role of the user's base position;

[0019] Departmental authority exceeded: The actual system role exceeds the scope of the system roles of all functional positions under the department to which the user belongs;

[0020] Leadership level privilege exceeding: The actual system role exceeds the scope of the system role of the user's leadership attribute, that is, a non-leadership ID has the role permissions of a leader;

[0021] Organization-level authority overstepping: The actual system role exceeds the scope of the system roles of all functional positions under the organization to which the user belongs.

[0022] Optionally, the three levels of warning include: lowest level warning, medium level warning and highest level warning, wherein the lowest level warning corresponds to exceeding authority of functional position, the medium level warning corresponds to exceeding authority of department, and the highest level warning corresponds to exceeding authority of leadership level and exceeding authority of organization level.

[0023] Optionally, the audit results are verified and fed back to reversely optimize the job role group, specifically including:

[0024] Provide feedback on the system's automatic audit results, set revision thresholds, reversely optimize role groups for functional positions, and automatically update authorized accounts.

[0025] To achieve the above-mentioned purpose, the present application also provides a role authority management device for a multi-organization business system, comprising: a memory;

[0026] and a processor connected to the memory, wherein the processor is configured to execute the steps of the method described above.

[0027] To achieve the above objectives, the present application also provides a computer storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a machine.

[0028] This application has the following advantages:

[0029] Through this approach, fragmented permissions are aggregated into functional positions—the smallest authorization unit—and specific functions are associated with benchmark positions. Administrators only need to manage the position-role group mapping, eliminating the need to handle massive amounts of dispersed permissions or create excessive roles. This significantly reduces the complexity and management costs of permission configuration. When an employee's position changes, they only need to adjust their functional position, and the system automatically synchronizes all associated system permissions, eliminating the inefficient "manual modification system by system" model. The response time for permission changes is reduced from hours to minutes, adapting to dynamic organizational adjustments. Through the detailed "base position → functional position" split, the same employee can hold multiple departmental positions. A departmental / organizational level overreach detection mechanism ensures cross-departmental permission conflicts. The audit model automatically compares actual permissions with the position benchmark, identifying four types of overreach, enabling automated permission auditing and compliance enforcement. Furthermore, a reverse optimization mechanism based on audit results is implemented, automatically revising the functional position role group. This addresses the problem that existing role-based authorization models are unable to adapt to complex and changing organizational regional structures and business scenarios, leading to various account permission management issues and posing security risks to business operations and development. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] To more clearly illustrate the embodiments of this application or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are merely illustrative, and those skilled in the art can, without inventive effort, derive other implementation drawings based on the provided drawings.

[0031] Figure 1 A flowchart of a method for managing role permissions in a multi-organization business system provided by at least one embodiment of the present application;

[0032] Figure 2 A schematic diagram of the association between base positions, functional positions, and specific system roles in a role authority management method for a multi-organization business system provided in at least one embodiment of the present application;

[0033] Figure 3 A module block diagram of a role authority management device for a multi-organization business system provided in at least one embodiment of the present application. DETAILED DESCRIPTION

[0034] The following specific embodiments illustrate the implementation of this application. Those familiar with the art can easily understand the other advantages and functions of this application from the content disclosed in this specification. Obviously, the described embodiments are part of the embodiments of this application, but not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0035] It should be noted that, in the claims and description of this application, the steps may be executed substantially in parallel or in reverse order under appropriate circumstances, depending on the functions involved.

[0036] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0037] Currently, business systems generally employ a role-based authorization model (RBAC). RBAC is a widely used access control strategy that assigns permissions to roles rather than directly to individual users. Users gain access to system resources by becoming members of appropriate roles. A role is an abstract concept that defines a specific set of permissions. These permissions allow role members to perform specific tasks or access specific resources, such as reading files, editing documents, downloading files, or accessing system functions.

[0038] The role-based authorization model has the following problems and shortcomings in the existing multi-organization and multi-system permission management:

[0039] 1. Complexity in permissions configuration: Permission models vary across systems, requiring enterprises to design unique permissions policies for each system. Managing these permissions is time-consuming and error-prone for large organizations. For example, an enterprise's systems may have 1,234 permissions. With an average of 69 employees in prefecture-level companies and 100 employees in provincial companies, the number of permissions far exceeds the number of positions, resulting in a decentralized nature.

[0040] 2. Slow response to permission changes: In a dynamic production environment, employee roles and responsibilities may change frequently due to adjustments to production plans. However, traditional multi-system permission changes require system-by-system and role-by-role operations, making it difficult to respond to these changes in a timely manner.

[0041] 3. Role explosion: As the complexity of the organizational structure increases, a large number of roles may emerge, leading to management difficulties.

[0042] 4. Difficulty adapting to complex organizational structures: Large enterprises have complex organizational structures. Employees may hold positions in multiple departments. Different departments or subsidiaries have access to different business systems and permissions. The RBAC model is difficult to meet such application scenarios.

[0043] 5. Permissions Auditing and Compliance Challenges: The decentralized nature of permissions management makes it difficult for enterprises to quickly generate comprehensive permission usage reports, which is a challenge for companies implementing strict production and security controls. Permission application and configuration are prone to errors, and the lack of unified rules for permissions auditing leads to management risks and business compliance risks.

[0044] To solve the above problems and deficiencies, an embodiment of the present application provides a role authority management method for a multi-organization business system, referring to Figure 1 , Figure 1 This is a flowchart of a method for role authority governance of a multi-organization business system provided in at least one embodiment of the present application. It should be understood that the method may also include additional boxes not shown and / or the boxes shown may be omitted, and the scope of the present application is not limited in this respect.

[0045] In step 101, a position-based authorization model is constructed: a system role group is established for each functional position, and the functional position is used as the minimum authorization unit to authorize users.

[0046] In some embodiments, the method specifically includes:

[0047] S1011. Position sorting and establishment: Obtain the personnel composition, benchmark position configuration, and division of responsibilities of each region and department, break down the benchmark positions into specific functions, obtain the corresponding functional positions, and output the relationship between the benchmark positions and the functional positions.

[0048] Specifically,

[0049] Characteristics of benchmark positions (i.e., human resources positions):

[0050] Based on the human resource planning settings of each branch, there are large regional differences and large fluctuations. One person has one position, and different functional positions may be repeated. For example, the baseline position of managers of different departments in a prefecture-level city is the full-time position of a Level 4 manager.

[0051] Features of functional positions:

[0052] 1. Combine the system process to break down specific functions into smaller functional position units. Companies of different sizes have different personnel function allocations. Small-scale cities may have one person in multiple functional positions, large-scale cities may have one person in one functional position, and some functions may involve multiple people in the same functional position.

[0053] 2. Functional positions are related to organizational structures. For example, the manager of the municipal general affairs department and the manager of the municipal finance department are two functional positions, and the manager of the provincial general affairs department are also two functional positions.

[0054] 3. Functional positions based on system functions have small regional differences and changes, and are applicable to different regions across the country.

[0055] 4. The job units are smaller, jobs are not repeated, one person can hold multiple jobs, and multiple people can hold one job, which facilitates flexible configuration and maintenance.

[0056] 5. Establish basic conditions for authority audit.

[0057] For example, if the base position is Data Auditor and the corresponding specific functions are Data Auditor and Account Manager, then the corresponding functional positions are: Province - Basic Authority Position, Province - Tongfa Business Branch - Account Manager, and Province - Tongfa Business Branch - Data Quality Management. For details, refer to Table 1.

[0058] Table 1:

[0059]

[0060] S1012. Role group sorting: Based on the principle of minimizing the permissions required to complete the specific functions, sort out the business system role groups corresponding to the functional positions, that is, one position includes all the necessary roles of the system.

[0061] For example: If the functional position is: Province-Basic Authority Position, the corresponding business system role is shown in Table 2.

[0062] Table 2:

[0063]

[0064] If the functional position is: Province-Tongfa Branch-Account Manager, the corresponding business system roles are shown in Table 3.

[0065] Table 3:

[0066]

[0067] If the functional position is: Province-Tongfa Industry Branch-Data Quality Management, the corresponding business system roles are shown in Table 4.

[0068] Table 4:

[0069]

[0070] S1013. Authorization management model based on benchmark positions: Based on actual application scenarios, obtain position management, query, display, and permission configuration functions based on benchmark position authorization.

[0071] For example: Wang XX, his department is the Communication and Distribution Department of the Provincial Company, and his basic position is Data Audit. When granting system permissions, you only need to select the corresponding basic position, and it will automatically be associated with the corresponding functional position and specific system role, without the need for separate authorization management for each system role. Figure 2 .

[0072] At step 102, an account authority audit model is constructed to audit user authority and obtain audit results. The specific rules are as follows:

[0073] S1021, Four-dimensional audit model:

[0074] Obtain the user's organizational level, department, and actual role list in each system, and compare and audit them with the role permissions of the user's benchmark position to determine whether the user has exceeded his or her authority and the type of authority exceeded.

[0075] In some embodiments, the override types include:

[0076] 1. Functional position exceeding authority: The actual system role exceeds the scope of the system role of the base position to which the user belongs.

[0077] 2. Departmental authority exceeding: The actual system role exceeds the scope of the system roles of all functional positions under the department to which the user belongs.

[0078] 3. Leadership level authority exceeding: The actual system role exceeds the scope of the system role of the user's leadership attribute, that is, a non-leadership work number has the leadership role authority.

[0079] 4. Organizational level authority exceeding: The actual system role exceeds the scope of the system roles of all functional positions under the organization to which the user belongs.

[0080] S1022. Three-level warning system: Three warning levels are created based on the type of unauthorized behavior. The highest level is used.

[0081] In some embodiments, the three warning levels include: the lowest warning level, the medium warning level, and the highest warning level, wherein:

[0082] Blue Alert: The lowest level of alert. This indicates that the department has exceeded its authority to initiate and view events. This corresponds to an excessive level of authority in the corresponding functional position.

[0083] Yellow Alert: A medium-level alert. This refers to an overreach of authority for a key position within the department, an overreach of authority for a regular employee, or an employee holding non-audit authority over a department leader. This corresponds to an overreach of authority within the department.

[0084] Red Alert: The highest level of alert. This refers to situations where authority is being overstepped within a department or department manager position, or an employee possesses department leader approval authority, or a non-company leader possesses company leader authority, or authority is being overstepped across organizational levels. This corresponds to both leadership-level and organizational-level authority overstepping.

[0085] S1023. Output and application of audit results: Output audit results based on personnel and position dimensions, and rectify personnel and positions that exceed their authority.

[0086] For example, consider Wang XX, an employee in the Provincial Company's Public Distribution Department, whose baseline position is Data Auditor. These corresponding functional positions include: Provincial - Basic Authority Position, Provincial - Public Distribution Branch - Account Manager, and Provincial - Public Distribution Branch - Data Quality Management. The user's organizational level, department, and actual roles in various systems are obtained and compared against the role permissions of their baseline position. The audit results are output, as shown in Table 5.

[0087] Table 5:

[0088]

[0089] At step 103, the audit results are verified and fed back to perform reverse optimization on the job role group.

[0090] Specifically, the system automatically audits the results and provides feedback, sets revision thresholds, reversely optimizes the role groups of functional positions, and automatically updates authorized accounts.

[0091] For example: When Role 1 is judged to have exceeded the authority of Position A, in actual applications, more than 60% (revised threshold, adjustable) of the unauthorized users report that they have not actually exceeded the authority. The system automatically adds Role 1 to the role group of Position A and automatically adds authorization to users who have been authorized to Position A.

[0092] Through the above method, fragmented permissions are aggregated into the minimum authorization unit of functional positions, and specific functions are associated with specific functions through benchmark positions. Administrators only need to manage the position-role group mapping, without having to deal with massive decentralized permissions or create too many roles, which greatly reduces the complexity of permission configuration and management costs. When an employee's position changes, only the functional position to which they belong needs to be adjusted, and the system automatically synchronizes all associated system permissions, changing the inefficient mode of "manual modification of each system one by one". The response time for permission changes is reduced from hours to minutes to adapt to dynamic organizational adjustments. Through the detailed splitting of "benchmark position → functional position", the same employee is supported to hold positions in multiple departments. The department / organization-level unauthorized access detection mechanism ensures that cross-departmental permissions do not conflict. The audit model automatically compares actual permissions with the position benchmark, identifies four types of unauthorized access, and realizes automated permission auditing and compliance enforcement. A reverse optimization mechanism based on audit results is implemented: automatic revision of functional position role groups.

[0093] Figure 3 A block diagram of a role authority management device for a multi-organization business system provided in at least one embodiment of the present application. The device includes:

[0094] Memory 201; and a processor 202 connected to the memory 201, the processor 202 is configured to: establish a system role group for each functional position, and authorize the functional position as the minimum authorization unit for the user;

[0095] Build an account permission audit model, audit user permissions, and obtain audit results;

[0096] The audit results are verified and fed back to reversely optimize the job role groups.

[0097] In some embodiments, the processor 202 is further configured to: establish a system role group for each functional position and authorize the user using the functional position as the minimum authorization unit, specifically including:

[0098] Obtain the personnel composition, benchmark position configuration, and division of responsibilities for each region and department, break down the benchmark positions into specific functions, obtain the corresponding functional positions, and output the relationship between the benchmark positions and the functional positions;

[0099] Based on the principle of minimizing the permissions required to complete the specific functions, sort out the business system role groups corresponding to the functional positions;

[0100] Based on actual application scenarios, obtain position management, query, display, and permission configuration functions based on benchmark position authorization.

[0101] In some embodiments, the processor 202 is further configured to: construct an account authority audit model, audit user authority, and obtain audit results, specifically including:

[0102] Obtain the user's organizational level, department, and actual role list in each system, and compare and audit the role permissions of the user's benchmark position to determine whether the user has exceeded their permissions and the type of violation.

[0103] Three warning levels are divided according to the types of overstepping authority;

[0104] Output audit results based on personnel and position dimensions, and rectify personnel and positions that exceed their authority.

[0105] In some embodiments, the processor 202 is further configured to: the override types include:

[0106] Functional position exceeding authority: The actual system role exceeds the scope of the system role of the user's base position;

[0107] Departmental authority exceeded: The actual system role exceeds the scope of the system roles of all functional positions under the department to which the user belongs;

[0108] Leadership level privilege exceeding: The actual system role exceeds the scope of the system role of the user's leadership attribute, that is, a non-leadership ID has the role permissions of a leader;

[0109] Organization-level authority overstepping: The actual system role exceeds the scope of the system roles of all functional positions under the organization to which the user belongs.

[0110] In some embodiments, the processor 202 is further configured as follows: the three levels of warning include: the lowest level warning, the medium level warning and the highest level warning, wherein the lowest level warning corresponds to the overstepping of authority of functional positions, the medium level warning corresponds to the overstepping of authority of departments, and the highest level warning corresponds to the overstepping of authority of leadership levels and organizational levels.

[0111] In some embodiments, the processor 202 is further configured to: verify and feedback the audit results to reversely optimize the job role group, specifically including:

[0112] Provide feedback on the system's automatic audit results, set revision thresholds, reversely optimize role groups for functional positions, and automatically update authorized accounts.

[0113] The specific implementation method is referred to the aforementioned method embodiment and will not be repeated here.

[0114] The present application may be a method, apparatus, system and / or computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present application.

[0115] A computer-readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure within a groove on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0116] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0117] The computer program instructions used to perform the operations of the present application can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer-readable program instructions can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, the state information of the computer-readable program instructions is used to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), so that the electronic circuit can execute the computer-readable program instructions, thereby implementing various aspects of the present application.

[0118] Various aspects of the present application are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0119] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, such that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0120] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0121] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the system, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and the part of the module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a special hardware-based system that performs the function or action of the specification, or can be implemented by a combination of special hardware and computer instructions.

[0122] Note that, unless otherwise explicitly stated, all features disclosed in this specification (including any accompanying claims, abstracts, and drawings) may be replaced by alternative features that achieve the same, equivalent, or similar purposes. Therefore, unless explicitly stated otherwise, each feature disclosed is merely an example of a group of equivalent or similar features. Where used, further, preferably, further, and more preferably are simply the beginning of another embodiment based on the previous embodiment, and the content following further, preferably, further, or more preferably is combined with the previous embodiment as a complete construction of another embodiment. Several further, preferably, further, or more preferably settings following the same embodiment can be arbitrarily combined to form another embodiment.

[0123] Although the present application has been described in detail above using general descriptions and specific embodiments, it will be apparent to those skilled in the art that modifications or improvements may be made based on the present application. Therefore, such modifications or improvements, which do not depart from the spirit of the present application, are within the scope of protection claimed in the present application.

Claims

1. A role authority management method for a multi-organization business system, characterized in that: include: Establish a system role group for each functional position, and use the functional position as the minimum authorization unit to authorize users, including: Obtain the personnel composition, benchmark position configuration, and division of responsibilities of each region and department, break down the benchmark positions into specific functions, obtain the corresponding functional positions, and output the relationship between the benchmark positions and the functional positions. Based on the principle of minimizing the permissions required to complete the specific functions, sort out the business system role groups corresponding to the functional positions, Based on actual application scenarios, obtain the position management, query, display, and permission configuration functions based on benchmark position authorization; Build an account permission audit model to audit user permissions and obtain audit results, including: Obtain the user's organizational level, department, and actual role list in each system, and compare and audit the role permissions of the user's benchmark position to determine whether the user has exceeded their permissions and the type of violation. The types of violation include: Functional position exceeding authority: The actual system role exceeds the scope of the system role of the user's base position. Departmental authority overstepping: The actual system role exceeds the scope of the system roles of all functional positions under the department to which the user belongs. Leadership level authority exceeded: The actual system role exceeds the scope of the system role of the user's leadership attribute, that is, a non-leadership ID has the role authority of a leader. Organizational level authority overstepping: The actual system role exceeds the scope of the system roles of all functional positions under the organization to which the user belongs. Three levels of warning are divided according to the types of overstepping authority: Output audit results based on personnel and position dimensions, and rectify personnel and positions that exceed their authority; Verify and provide feedback on the audit results to reversely optimize the job role groups, including: Provide feedback on the system's automatic audit results, set revision thresholds, reversely optimize role groups for functional positions, and automatically update authorized accounts.

2. The role authority management method for a multi-organization business system according to claim 1 is characterized in that: The three levels of warning include: lowest level warning, medium level warning and highest level warning, among which the lowest level warning corresponds to the exceeding of authority of functional positions, the medium level warning corresponds to the exceeding of authority of departments, and the highest level warning corresponds to the exceeding of authority of leadership levels and organizational levels.

3. A role authority management device for a multi-organization business system, characterized in that: include: Memory; and a processor connected to the memory, the processor being configured to perform the steps of the method according to any one of claims 1 to 2.

4. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a machine, the steps of the method according to any one of claims 1 to 2 are implemented.

Images