Data processing system

Abstract

The present application relates to a system that automatically and optimally performs account creation, deletion, permission change, etc. of multiple business systems in conjunction with personnel events such as the entry, exit, transfer, etc. of all employees including business entrustment contract employees in the communication industry, IT-related companies, etc. It has a personnel information management unit, an event detection unit, an account permission automatic management unit, a generative AI execution unit, etc. The generative AI analyzes the business content of the employee, the past permission history, the security policy, the system utilization status, etc. While preventing deletion omissions or permission assignment errors, it realizes the optimal account management steps or abnormal processing, automatic recording of audit traces. As a result, it can simultaneously achieve reduction of security risks, operational efficiency, and governance enhancement.

Description

Technical Field

[0001] The technology disclosed herein relates to a system. Background Technology

[0002] Patent Document 1 discloses a personalized chatbot control method executed by at least one processor, the method comprising: receiving user speech; adding the user speech to a prompt containing instructions related to a chatbot role; encoding the prompt; and inputting the encoded prompt into a language model to generate chatbot speech in response to the user speech.

[0003] Patent document 1: Japanese Patent Application Publication No. 2022-180282.

[0004] The problem this invention aims to solve is to comprehensively and efficiently address multifaceted issues. For example, in telecommunications or IT-related companies with a large number of employees, including those on business contracts, and frequent personnel events such as onboarding, offboarding, and transfers, the management of accounts in various business systems—including the issuance, deletion, and permission changes—is complex and reliant on manual operations. This makes it easy for accounts of departing or transferred employees to be deleted or for permissions to be incorrectly granted, inherently posing significant security risks such as information leakage or unauthorized access. Furthermore, as the types and number of business systems under management increase, account management becomes increasingly complex. The increased workload and costs of human resource management systems make them prone to human error and delays in response. Furthermore, it is difficult to optimize permission settings and anomaly handling to adapt to changes in employee job duties and organizational structure. In addition, the visualization and automation of account management audit trails and security policy compliance are not fully realized. To address these issues, this paper proposes a mechanism that leverages generative AI to enable unified and autonomous automatic management, optimization, auditing, and anomaly handling of accounts and permissions by linking the HR system with various business systems. The aim is to simultaneously reduce security risks, improve operational efficiency, cut management costs, and strengthen governance. Summary of the Invention

[0005] The means to solve the problem involved in this invention is to construct a system comprising a personnel information management department, an event detection department, an automatic account permission management department, and a generative AI execution department. First, the personnel information management department centrally manages personnel event information such as onboarding, offboarding, and transfers of all employees, including those with business contracts. The event detection department monitors and records personnel events in the personnel information management department in real time or at predetermined intervals to detect events immediately. Based on the events detected by the event detection department, the automatic account permission management department automatically performs account creation, deletion, and permission changes for the employee across multiple business systems. In the processing of the automatic account permission management department, the generative AI execution department analyzes various information such as the employee's role, business content, department, past permission history, and security policies. Generative AI is used to autonomously determine and execute optimal account permission settings, deletion procedures, exception handling, and audit log generation. This prevents omissions or incorrect permission assignments during account deletion for departing or transferred employees, reduces security risks such as information leakage or unauthorized access, and simultaneously achieves high efficiency in account management, reduced workload, and enhanced governance. Attached Figure Description

[0006] Figure 1 This is a conceptual diagram illustrating an example of the configuration of a data processing system according to the first embodiment.

[0007] Figure 2 This is a conceptual diagram illustrating an example of the main functions of the data processing apparatus and smart device according to the first embodiment.

[0008] Figure 3 This is a conceptual diagram illustrating an example of the data processing system configuration in the second embodiment.

[0009] Figure 4 This is a conceptual diagram illustrating an example of the main functions of the data processing device and smart glasses according to the second embodiment.

[0010] Figure 5 This is a conceptual diagram illustrating an example of the data processing system configuration in the third embodiment.

[0011] Figure 6 This is a conceptual diagram illustrating an example of the main functions of the data processing device and head-mounted terminal according to the third embodiment.

[0012] Figure 7 This is a conceptual diagram illustrating an example of the data processing system configuration in the fourth embodiment.

[0013] Figure 8 This is a conceptual diagram illustrating an example of the functions of the main parts of the data processing device and robot according to the fourth embodiment.

[0014] Figure 9It represents an emotion graph that maps multiple emotions.

[0015] Figure 10 It represents an emotion graph that maps multiple emotions.

[0016] Explanation of reference numerals in the attached figures Data processing systems 10, 210, 310, and 410 12 Data processing device 14 Smart devices 214 Smart Glasses 314 Head-mounted terminal 414 Robot. Detailed Implementation

[0017] Hereinafter, an example of an implementation of the system involved in this disclosure will be described with reference to the accompanying drawings.

[0018] First, let's explain the terms used in the following description.

[0019] In the following embodiments, the processor (hereinafter referred to as "processor") can be a single computing device or a combination of multiple computing devices. Furthermore, a processor can be a single computing device or a combination of multiple computing devices. Examples of computing devices include CPU (Central Processing Unit), GPU (Graphics Processing Unit), GPGPU (General-Purpose computing on Graphics Processing Units), APU (Accelerated Processing Unit), etc.

[0020] In the following implementation, the labeled RAM (Random Access Memory) is a memory that temporarily stores information and is used by the processor as working memory.

[0021] In the following embodiments, the labeled memory is one or more non-volatile storage devices used to store various programs and various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), disk (e.g., hard disk) or magnetic tape, etc.

[0022] In the following implementation, the labeled Communication I / F (Interface) is an interface that includes a communication processor and an antenna, etc. The Communication I / F is responsible for communication between multiple computers. Examples of communication standards applicable to the Communication I / F include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0023] In the following implementation, "A and / or B" is synonymous with "at least one of A and B". That is, "A and / or B" means that it can be only A, only B, or a combination of A and B. Furthermore, in this specification, when "and / or" connects more than three items, the same approach as "A and / or B" applies.

[0024] [First Implementation] Figure 1 An example of the configuration of the data processing system 10 according to the first embodiment is shown.

[0025] like Figure 1 As shown, the data processing system 10 includes a data processing device 12 and an intelligent device 14. An example of the data processing device 12 is a server.

[0026] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0027] The smart device 14 includes a computer 36, a receiver 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the receiver 38, output device 40, camera 42, and communication I / F 44 are also connected to the bus 52.

[0028] The receiving device 38 includes a touchscreen 38A and a microphone 38B, etc., for receiving user input. The touchscreen 38A receives user input generated by contact with an indicator (e.g., a pen or finger). The microphone 38B receives user input generated by sound by detecting the user's voice. The control unit 46A in the processor 46 sends data representing user input received through the touchscreen 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data representing the user input.

[0029] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting data in a form perceptible to the user 20 (e.g., sound and / or text). The display 40A displays visual information such as text and images according to instructions from the processor 46. The speaker 40B outputs sound according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0030] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for sending and receiving various information between processor 46 and processor 28 via network 54.

[0031] Figure 2 An example of the main functions of the data processing device 12 and the smart device 14 is shown.

[0032] like Figure 2 As shown, in the data processing apparatus 12, specific processing is performed by the processor 28. A specific processing program 56 is stored in the memory 32. The specific processing program 56 is an example of a "program" as understood in this disclosure. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 based on the specific processing program 56 executed on the RAM 30.

[0033] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the specific processing unit 290. The specific processing unit 290 can use the emotion-specific model 59 to infer the user's emotions and perform specific processing based on the user's emotions. The emotion inference function using the emotion-specific model 59 (emotion-specific function) includes various inferences and predictions related to the user's emotions, but is not limited to this example. Furthermore, emotion inference and prediction also include, for example, emotion analysis (analysis).

[0034] In the smart device 14, the processor 46 performs the receive / output processing. The memory 50 stores the receive / output program 60. The receive / output program 60 is used in conjunction with the data processing system 10 and the specific processing program 56. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on the RAM 48. The receive / output processing is implemented by the processor 46 acting as a control unit 46A based on the receive / output program 60 executed on the RAM 48. Furthermore, the smart device 14 may also have the same data generation model and emotion-specific model as the data generation model 58 and the emotion-specific model 59, and use these models to perform the same processing as the specific processing unit 290. The receive / output processing is implemented by the processor 46 acting as a control unit 46A based on the receive / output program 60 executed on the RAM 48.

[0035] In addition, other devices besides the data processing device 12 may also have a data generation model 58.

[0036] For example, a server device (e.g., a generation server) may have a data generation model 58.

[0037] In this case, the data processing device 12 obtains the processing results (prediction results, etc.) using the data generation model 58 by communicating with a server device that has the data generation model 58. Furthermore, the data processing device 12 can be a server device or a user-owned terminal device (e.g., a mobile phone, robot, home appliance, etc.). Next, an example of the processing performed by the data processing system 10 of the first embodiment will be described.

[0038] (Example 1) The specific processing flow in Example 1 will be described below. Each part of the system described below is implemented by the data processing device 12 and the smart device 14. Furthermore, the data processing device 12 is referred to as the "server" and the smart device 14 is referred to as the "terminal".

[0039] (Implementation methods for carrying out the present invention) Regarding the implementation of this invention, based on the premise of using a server and terminal structure, a detailed and specific description is given of the specific actions of each part, the method of utilizing generative AI, the overall system process, practical application examples, exception handling, security countermeasures, operation examples for managers and users, processing of various logs and audit trails, system scalability, linkage with other systems, fault response, and even education and application support.

[0040] First, the Human Resources Information Management Department operates on a server, managing all personnel-related data in a unified database. This database includes information on all employees, including those under business contracts, full-time employees, dispatched employees, and part-time employees. This data encompasses their attribute information, employment type, start date, end date, transfer history, department, projects, position, contact information, emergency contact information, past performance reviews, qualifications, educational history, past account permissions, and system usage history. For example, if employee A started on April 1, 2024, transferred from the sales department to the information systems department on June 1, 2024, and left on December 31, 2024, all these events are recorded chronologically, and the relevant business systems and permission information for each event are also linked and maintained. On the client side, HR managers can use a web browser or dedicated application to view and modify employee information, register events, confirm history, import / export CSV files, and set up API linkage. Specifically, the Human Resources Information Management Department builds a relational database management system on the server's main storage and auxiliary storage devices. The Human Resources Information Management Department standardizes employee attribute information, splits it, and stores it in multiple data tables. Each employee is assigned a unique identifier. This identifier is used as the primary key to link the tables. Personnel events occurring in a time-series format are recorded as transaction data. Each event record is timestamped. To improve retrieval speed, frequently searched columns such as department and position are automatically indexed using B-tree indexes. The department receives data retrieval requests from terminals. These requests are converted into SQL queries. The queries are executed using a database engine. The extracted data is serialized into a JSON payload. Data is sent to the terminals via an encrypted communication path. When importing CSV files, validation checks are performed to detect inconsistencies in data types or missing required items. If an error is detected, the row is skipped, and an error log is generated. As a result of this technology, the Human Resources Management Department eliminates data redundancy and reduces storage capacity. Through the effective use of indexes, the department reduces retrieval latency for millions of records to milliseconds. Specifically, this system is used as a global human resources information integration platform in multinational corporations with tens of thousands of employees.

[0041] The event detection department runs on a server, monitoring the HR information management department's database in real time. For example, it automatically extracts employees whose scheduled start date is today and detects them as start dates. It automatically detects employees whose departure date is approaching and processes them as departure dates. It detects employees whose transfer date is approaching as transfer dates. These detections can correspond to any of the following: periodic batch processing (e.g., every 5 minutes, every hour, once a day), API-based real-time event notifications, or manual registration by HR personnel. On the client side, it automatically sends email notifications, chat notifications, push notifications, etc., to managers and relevant personnel when an event occurs, providing interfaces to facilitate confirmation and acknowledgment of event content, input of additional information, etc. Specifically, the event detection department performs periodic polling of the HR information management department's database. It compares the last polling execution time with the current system time. It extracts the timestamps of records updated within that time range. It parses the differential data of the extracted records. It detects markers indicating specific state transitions such as start or departure. Upon detecting a state transition, the event detection department generates an event message containing a code representing the corresponding event category and an employee identifier. The department publishes this event message to a queue in an asynchronous message broker. The department exposes a webhook endpoint on the server for receiving real-time notifications via an API. The department receives HTTP POST requests from external systems. It parses the JSON data within the request body. It extracts event information from the parsed data. During notification processing, the department retrieves the contact information of the destination manager from the database. It then sends the notification data to the mail server using the SMTP protocol. As a result, the event detection department distributes the continuous query load on the database, reducing server CPU utilization. By employing asynchronous messaging, the department prevents event omissions and improves overall system throughput. Specifically, this system is used in the real-time permission switching system of the talent dispatch industry, where there are frequent daily onboarding, offboarding, and transfers.

[0042] The Account and Permission Automation Department runs on the server. Based on event information notified by the Event Detection Department, it automatically performs actions such as account creation, deletion, permission changes, password initialization, account locking, access restrictions, two-factor authentication settings, usage period settings, account activation / deactivation, group addition / deletion, role assignment, and API key issuance / deactivation for various business systems (e.g., email systems, file sharing systems, groupware, project management systems, cloud disks, customer management systems, expense settlement systems, attendance management systems, remote access systems, VPNs, network devices, physical access control systems, etc.). For example, during an onboarding event, the department automatically creates the necessary business system accounts based on the employee's department, position, and projects, issues initial passwords, and automatically adds the necessary permissions and groups. During an offboarding event, the department automatically deletes the corresponding employee's account from all business systems. For systems where deletion is not possible, the account is deactivated, access permissions are revoked, API keys and tokens are invalidated, and physical access is immediately suspended. When an employee transfers a business system, the system automatically removes permissions from the old department, automatically assigns the necessary permissions to the new department, and automatically performs permission transfer on a project-by-project basis. For example, if employee B is transferred from the sales department to the development department, access permissions to the sales system are removed, and administrator permissions are granted to the development system. Furthermore, to prevent duplicate and conflicting permissions across multiple business systems, permission consistency checks are automatically implemented. Specifically, the account permission automatic management department subscribes to event messages from an asynchronous message broker. It uses the employee identifier contained in the event message as the key to retrieve detailed attribute information from the human resources information management department. It compares the retrieved attribute information with predefined role-based access control policy rules. It identifies the group of business systems to be accessed. It generates HTTP requests for the endpoints of the RESTful APIs provided by each business system. It includes an access token based on the OAuth authentication protocol in the request header. It stores the account creation and permission change parameters in JSON format in the request body. Finally, it sends the request via a network interface. The account permission automatic management department receives HTTP status codes from business systems. If the status code indicates success, the department logs the processing completion. During permission consistency checks, the department retrieves the current permission status from each business system. It calculates the difference between the retrieved set of permission statuses and the expected set of permission statuses based on policy rules. If the difference set is not empty, the department detects an inconsistency. It then automatically issues additional API requests to eliminate the inconsistency.As a result of this technology, the automated account access management system completely eliminates manual configuration, mathematically reducing the probability of security incidents caused by configuration errors to near zero. This system uses parallel processing threads to send requests to multiple business systems simultaneously, significantly reducing overall processing time. Specifically, this system is used in financial institutions with stringent access control requirements for the automated lifecycle management of privileged IDs.

[0043] The generative AI execution unit runs on a server and uses it to analyze, judge, and optimize various types of information within the automated account and permission management unit. For example, it comprehensively analyzes an employee's role, business content, department, past permission history, system usage history, organizational permission hierarchy, security policies, past data on missed deletions or incorrect permission granting, audit trails, external threat information, and legal compliance requirements. For instance, when deleting an employee's account, it learns past deletion patterns and system dependencies, automatically targeting and prioritizing systems with high deletion risks. For instance, during transfers, it analyzes the employee's business content and the permission requirements of both the old and new departments, automatically generating optimal permission granting / deletion steps. For instance, when an employee works across multiple projects, it analyzes the system usage and permission history of each project, optimizing account deletion and permission revocation upon departure on a project-by-project basis. For instance, if an employee is temporarily granted managerial permissions, it automatically revoks those permissions to ensure no unnecessary managerial permissions remain after a transfer. For example, when an employee utilizes multiple cloud platforms and external services, generative AI, via API linkage, performs account deletion and permission changes for all external services simultaneously, preventing omissions in deletions and errors in permission granting. For example, in the event of an urgent employee departure, generative AI can instantly lock all accounts across the system and automatically send alerts prompting managers to take immediate action. For example, when an employee conducts business across multiple contract types and employers, generative AI analyzes the contract content and the permission requirements of each employer, automatically generating optimal account management steps for each contract. Specifically, the generative AI execution unit deploys a large-scale language model based on a Transformer architecture with a self-attention mechanism on a server GPU cluster. This generative AI execution unit converts structured data such as personnel information, permission history, and system usage history into natural language text prompts. The generative AI execution unit uses a tokenizer to convert this text prompt into an array of integer token IDs. The generative AI execution unit maps the token ID array to a multi-dimensional embedding vector space. The generative AI execution unit inputs this embedding vector as an input tensor into the large-scale language model. As specific examples of input data, firstly, there exists a 512-dimensional feature vector, quantified by the employee's department, position, and past system login frequency. Secondly, there exists an array of tokens arranged chronologically according to the permission change history over the past year. Thirdly, there exists adjacency matrix data representing the dependencies between various business systems. This generative AI execution unit uses multiple attention heads within a large-scale language model to compute the correlations between the elements of the input tensor. The generative AI execution unit performs a forward propagation calculus, outputting the probability distribution of each token's occurrence from the output layer. Based on this probability distribution, the generative AI execution unit generates text data representing the optimal account management steps.As specific examples of the output data, firstly, there are floating-point scores ranging from 0.0 to 1.0 representing the deletion recommendation score for each business system. Secondly, there are string labels representing the role names of the permissions to be granted. Thirdly, there is JSON-formatted data representing the order and parameters of the API calls to be executed. The generative AI execution unit inputs the output JSON data into the parser module. The parser module extracts specific command groups from the JSON data. The parser module sends the extracted command groups to the account permission automatic management unit, triggering the actual API calls. The generative AI execution unit uses past deletion omission case data as teacher data, and fine-tunes the model's weight parameters through backpropagation to minimize the cross-entropy error function. As a result of this technology, the generative AI execution unit analyzes complex system dependencies and exceptional employment patterns that are difficult to describe in existing rule-based methods in a multi-dimensional space, deriving optimal permission management steps that are undetectable by humans. Through high-dimensional vector calculus, the generative AI execution unit can also predict risks with high accuracy for unknown permission granting patterns. As a specific application area, this system is used in IT companies that combine multiple cloud services to automatically detect shadow IT and implement permission correction systems.

[0044] Furthermore, generative AI is also utilized for the automatic recording and visualization of audit trails and security policy compliance status in account management. For example, it automatically records the creation, deletion, and permission change history of each account, automatically generating reports for audit responses and internal controls. For example, when a violation of security policy permission settings is detected, generative AI can automatically suggest corrective measures and notify administrators. For example, during audit responses, past account management history is visualized in a time-series format, automatically generating dashboards that clearly show who granted or deleted what permissions at what time. For example, when compliance requirements are changed, generative AI can automatically propose permission settings based on the new requirements, which are then automatically applied after administrator approval. Specifically, the generative AI execution unit collects the massive system log data output from the audit log unit. This unit extracts features such as operation date and time, operator ID, object system, and operation content from the collected log data. The extracted features are then normalized and converted into a time-series numerical array. The generative AI execution unit inputs the numerical array data as an input tensor into a neural network model specialized for anomaly detection. Specific examples of the input data include: first, a one-dimensional array normalized to the number of API calls made by each user over the past 30 days; second, vectorized data containing the geographic information of the IP addresses that performed the operation. As output of the model, the generative AI execution unit calculates an anomaly score for each log entry. Specific examples of the output data include: first, an anomaly score representing the deviation from the normal operating pattern as an integer value from 0 to 100; second, text data explaining the reasons for the anomaly determination in natural language; and third, a string of specific system commands to be executed for correction. If the anomaly score exceeds a pre-set threshold, the generative AI execution unit initiates an alert generation module as a subsequent processing step. This alert generation module generates a notification message containing detailed information about the anomaly and a correction plan, and sends it to the administrator's terminal. The generative AI execution unit periodically crawls and acquires external text data representing changes in regulatory compliance requirements. The generative AI execution unit uses natural language processing techniques to extract new constraints from the text data. This generative AI execution unit maps extracted constraints to parameters in existing security policies, automatically generating updated policy documents. As a result, this generative AI execution unit can instantly detect minute anomalies in millions of lines of log data that are imperceptible to the human eye, enabling early detection of security incidents. This generative AI execution unit automates policy updates in response to changes in regulations, reducing the risk of compliance violations. Specifically, this system is used in automated auditing and compliance maintenance systems in medical institutions and public organizations that require strict compliance with personal information protection laws and various industry regulations.

[0045] On the terminal side, a dashboard is provided that allows managers and HR personnel to check the account management status of each employee, generative AI-based risk assessment results, alarm notifications, audit trails, etc., in real time via a web browser or dedicated application. For example, managers can also apply for account locking and granting of exceptional permissions in emergencies from the terminal. They can also manually register employee transfers and departures from the terminal, triggering account management processes immediately. Furthermore, they can download audit reports from the terminal and submit them to external auditors and management. Specifically, the terminal receives HTML, CascadingStyleSheets, and JavaScript files sent from the server. The terminal uses the browser's rendering engine to parse these files, building a document object model tree in memory. The terminal uses a front-end framework to generate a virtual document object model. A persistent communication session using the WebSocket protocol is established between the terminal and the server. The terminal receives JSON-formatted update data sent from the server in real time. The terminal updates the virtual document object model based on the received data. The terminal calculates the difference between the virtual model before and after the update. The terminal applies only the difference to the actual document object model, rapidly updating the screen's depiction. This terminal detects mouse clicks and keyboard inputs from administrators via an event listener. Upon receiving an emergency account lockout request, the terminal generates a payload containing the object's account identifier and the lockout command. This payload is sent to the server as an HTTPS request encrypted using the TransportLayerSecurity protocol. The terminal receives binary data of audit reports in PDF or CSV format from the server. The terminal saves the received binary data as a file to local storage. As a result of this technology, the terminal uses a differential rendering algorithm to minimize the CPU load and memory consumption required for screen re-rendering, reducing the response latency to user operations to milliseconds. The terminal prevents data eavesdropping and tampering over the network through encrypted communication. Specifically, this system is used in large-scale call centers where multiple administrators access the system simultaneously and are required to make instantaneous judgments and operations.

[0046] As for system scalability, a structure is adopted that allows for easy addition of new business systems and external services through API integration and plugins. For example, for newly imported cloud services, generative AI can automatically parse API specifications and generate account management processes. Similarly, for integration with overseas locations and group companies, multi-language compatibility, time zone compatibility, and local regulatory compliance are automatically optimized. Specifically, this system containers each function as an independent microservice. These containers run on a container orchestration platform. When a new business system is added, the system uses dynamic API discovery to automatically register the URLs of new endpoints in the registry. The system uses a generative AI execution unit to read the OpenAPI format JSON or YAML file that serves as the API specification for the new system. This generative AI execution unit parses the patterns of paths, methods, and request bodies within the specification. Based on the parsing results, it automatically generates adapter code that defines data mapping rules and communication protocols for communication with the new system. The system dynamically compiles the automatically generated adapter code and loads it into the execution environment. This system, in its collaboration with overseas locations, obtains the system timezone settings of the servers at each location. Using Coordinated Universal Time (UTC) as the base, the system calculates timestamp offsets to accurately synchronize the order of events. It extracts the user's regional setting information from the HTTP request header. The system loads the language resource file corresponding to the regional setting information into memory and dynamically switches the interface's display language. As a result, this technology allows for continuous addition of collaboration functions with new external services without requiring system modifications or restarts, maximizing system availability. Through automatic timezone correction, the system eliminates inconsistencies in the sequential order of distributed transactions in a global environment. Specifically, this system is used as a unified ID management platform in global corporate groups that frequently engage in acquisitions and require rapid integration of diverse IT systems.

[0047] As a contingency plan, in the event of failed account deletion and permission change processing, the generative AI automatically proposes retry procedures and alternative steps, and notifies the administrator. For example, if the business system linked to the API goes down, reprocessing is automatically executed after recovery. For example, if the deleted object account no longer exists, this is automatically recorded in the audit trail and reported to the administrator. Specifically, when sending API requests to external systems, the system starts a timer to measure response time. If there is no response within the pre-set timeout period, or if an HTTP status code of the 500 range is received, the system determines that a communication failure has occurred. Upon detecting a failure, the system transitions the circuit breaker module to the open state, temporarily blocking subsequent useless request transmissions. The system executes an exponential backoff algorithm. The system registers requests to the resend queue while increasing the retry interval exponentially. The system uses a generative AI execution unit to parse the error message and stack trace of the failure. This generative AI execution unit categorizes the cause of the error as a temporary network outage, expired authentication information, or non-existent object account. Upon receiving a 404 error indicating that the target account does not exist, this system cancels the retry process. The system inserts a log record into the audit log database containing a status code and timestamp indicating that processing was skipped due to the non-existent account. This system uses distributed tracing technology to assign a unique tracing ID to each request. The system records the processing path across multiple microservices and the processing time at various locations, identifying specific bottlenecks. As a result, this system prevents cascading failures originating from external system malfunctions, avoiding overall system resource exhaustion. Through exponential function-based retry control, the system prevents concentrated traffic to subsequently recovering external systems, achieving stable reconnection. Specifically, this system is used in manufacturing industries that require high-fault-resistance permission synchronization systems that interact with multiple overseas factories operating in unstable network environments.

[0048] As an educational and application support tool, generative AI provides managers and HR professionals with best practices and past application cases for account management, explanations of security risks, automated guidance on operation steps, and automatic FAQ generation. For example, it enables new managers to view operation manuals and tutorial videos from their terminals. It also automatically extracts past cases of missed deletions and incorrect permission granting, utilizing them as attention-grabbing and educational materials. Specifically, this system builds a retrieval-enhanced generative architecture on the server. The system segments past text files such as operation manuals, security guidelines, and troubleshooting history into blocks. It uses an embedding model to convert each block into high-dimensional vector data. This vector data is indexed and stored in a vector database. The system receives query text from managers from their terminals. The system also vectorizes the query text to generate query vectors. The system calculates the cosine similarity between the query vector and each document vector in the vector database. The system extracts the higher-level document blocks with high similarity. The extracted blocks are incorporated into the prompts as context and input into the generative AI execution unit. As specific examples of input data, firstly, there is a user query vector such as "Please tell me the steps for granting permissions to a new employee." Secondly, there is text data of relevant manuals extracted from the vector database. The generative AI execution unit generates accurate answer text for the question based on the context. As specific examples of output data, firstly, there is text describing the specific operation steps step-by-step. Secondly, there is a URL link to the manual to be consulted. The system displays the generated answer text on the terminal screen in a chat format. The system extracts records containing error codes indicating permission granting errors from past audit logs. The system parses the operation patterns of the extracted records and dynamically renders warning pop-ups on the screen for managers attempting similar operations. As a result of this technology, the system provides an intuitive interface based on natural language, significantly reducing the learning cost and time required for managers to become proficient in the system. Through a combination of vector retrieval and generative AI, the system generates highly accurate, context-sensitive answers in milliseconds that cannot be reached by simple keyword retrieval alone. As a specific application area, this system is utilized in self-solving help desk systems in outsourcing centers with diverse IT literacy and frequently changing managers.

[0049] Thus, the embodiments of this invention comprehensively realize unified management of personnel information, event detection, automatic management of account permissions, and optimization / anomaly handling / audit logging based on generative AI on the server side. On the terminal side, it provides interfaces for managers and HR personnel to understand the system status and perform necessary operations and approvals. This achieves highly accurate and efficient automation of account management for all employees, including those with business contracts, simultaneously reducing security risks, alleviating operational load, strengthening governance, improving audit response capabilities, reducing operational costs, ensuring system scalability, and even providing educational and operational support. Specifically, this system configures an in-memory database on the server's main memory as a cache for frequently accessed personnel information and permission policies. This system eliminates disk I / O bottlenecks, minimizing end-to-end latency from event detection to the completion of automatic changes in account permissions. This system employs an event loop architecture combining multi-threaded processing and asynchronous I / O. Even with tens of thousands of simultaneous events, this system suppresses the overhead caused by thread context switching, maintaining high throughput. In the generative AI inference processing, this system applies model quantization techniques. This system halves GPU VRAM consumption by reducing floating-point precision to 16-bit or 8-bit. It improves inference speed while maintaining the accuracy of permission optimization. The system uses binary serialization for communication between modules. Compared to JSON, this system reduces network bandwidth consumption and saves CPU cycles for parsing and processing. As a result, the system maximizes hardware resource utilization, enabling the same server to handle several times more transactions than before. Through the synergy of automation and AI-based optimization, the system reduces the human resource costs required for operation while physically eliminating security vulnerabilities caused by human error. In specific application areas, this system is utilized as a comprehensive authentication and authorization platform for mission-critical tasks in large IT platforms with tens of thousands of employees, thousands of business systems, and thousands of permission change requests per second.

[0050] (System Composition) The system involved in this implementation includes a Human Resources Information Management Department, an Event Detection Department, an Account Permission Automatic Management Department, a Generative AI Execution Department, a User Interface Department, an Audit Record Department, and an External System Linkage Department. The Human Resources Information Management Department is responsible for the unified management of information regarding employees with various employment forms, such as those under business contracts, formal employees, dispatched employees, and part-time employees. For example, it maintains a database containing employee names, employee numbers, start dates, end dates, transfer history, departments, projects, positions, contact information, emergency contact information, qualification information, educational history, past performance reviews, past account permission history, and system usage history. This database can record multiple events in chronological order, such as employee A starting on April 1, 2024, transferring from the sales department to the information systems department on June 1, 2024, and leaving on December 31, 2024. Furthermore, the business systems and permission information related to each event are also managed in a correlated manner. In addition, HR managers can use web browsers or dedicated applications to view and modify employee information, register events, confirm history, import / export CSV files, and set up API linkage. Specifically, this system implements the HR Information Management Department as a graph database on the server. This HR Information Management Department defines entities such as employees, departments, projects, and positions as nodes. It defines relationships such as affiliation, responsibility, and management as edges. For each node and edge, the HR Information Management Department assigns attributes such as start date and departure date in key-value pairs. For employee A's node, the HR Information Management Department generates an "affiliation" edge between it and the Sales Department node, starting from April 1, 2024. The HR Information Management Department sets the endpoint of this edge and invalidates it on June 1, 2024. Simultaneously, the HR Information Management Department generates a new "affiliation" edge between it and the Information Systems Department node. The HR Information Management Department uses a graph search algorithm to quickly traverse the nodes of related projects and colleagues within a certain number of hops from a specific employee. The Human Resources Information Management Department receives a CSV import request from the terminal. It reads the file stream into a memory buffer. It then uses multi-threading to parse the data row by row in parallel. The parsed data is converted into a graph database query language and submitted as a batch. As a result, the department performs data retrieval of hierarchical and network structures—requiring complex JOIN operations in relational databases—using only pointer tracing, reducing query execution time to logarithmic order. By managing time-series events as edge attributes, it instantly reconstructs the organizational structure at any past point in time. In specific application areas, this system is utilized as a next-generation human resources data platform in advanced technology companies with complex and dynamically changing employee affiliations, such as matrix organizations and agile development teams.

[0051] The Event Detection Department monitors the Human Resources Management Department's database in real-time or at predetermined intervals, detecting events such as onboarding, offboarding, and transfers immediately. For example, it can automatically identify employees whose scheduled onboarding date is today and detect them as onboarding events, automatically detect employees whose offboarding date is today and process them as offboarding events, or detect transfers on their scheduled transfer dates as transfer events. These detections correspond to any of the following: periodic batch processing, API-based real-time event notifications, or manual registration by HR personnel. When an event occurs, it automatically sends email notifications, chat notifications, push notifications, etc., to managers and relevant personnel, and also provides interfaces for confirming and acknowledging event content and inputting additional information. For example, if employee B's offboarding date is drastically changed, the event can be detected immediately, triggering account deletion across the entire system. Specifically, the Event Detection Department deploys a stream processing engine on the server. It uses change data capture technology to read the transaction logs of the Human Resources Management Department's database in real time. The Event Detection Department then inputs the read log streams into window functions in memory. The event detection department collects event data at specified time intervals and performs stateful processing to maintain state. It detects UPDATE commands related to employee B's departure date change from the log stream. The department compares the departure date before and after the change. If the changed departure date is earlier than or the same as the current time, it generates an immediate trigger event. The department pushes the generated trigger event to a message queue in memory. To send push notifications, the department retrieves the device token for the object manager's terminal from the database. It asynchronously sends an HTTP request containing the device token and message payload to the external push notification service API. As a result, the event detection department completely eliminates the load caused by periodic database polling, reducing the latency from event occurrence to detection to less than milliseconds. Through stateful stream processing, the department calculates accurate state transitions even for event logs arriving in reverse order, preventing false detections. In a specific application area, this system is used as an emergency account suspension mechanism in the trading systems of securities companies that require access control to be revoked in seconds.

[0052] The Account Permission Automation Department automatically manages employee accounts across multiple business systems based on event information notified by the Event Detection Department. This includes account creation, deletion, permission changes, password initialization, account locking, access restrictions, two-factor authentication settings, usage period settings, account activation / deactivation, group addition / deletion, role assignment, and API key issuance / deactivation. For example, during an onboarding event, the department automatically creates necessary business system accounts based on the employee's department, position, and projects, issues initial passwords, and automatically adds the required permissions and groups. During a departure event, the department automatically deletes the employee's account from all business systems. For systems where deletion is not possible, the account is deactivated, access permissions are revoked, API keys and tokens are invalidated, and physical access is immediately suspended. During transfer events, the department automatically deletes permissions from the old department, automatically grants the necessary permissions to the new department, and automatically transfers permissions on a project-by-project basis. For example, if employee C transfers from the sales department to the development department, access permissions to the sales system are deleted, and administrator permissions are granted to the development system. Furthermore, to prevent duplicate and conflicting permissions across multiple business systems, automatic permission consistency checks are implemented. Specifically, the Account Permission Automated Management Department builds a state machine on the server to control distributed transactions. Upon receiving event information, the department generates a directed acyclic graph (DAG) defining a series of API call tasks for each business system. The department executes tasks sequentially or in parallel based on the graph's dependencies. In each API call, the department assigns a unique transaction ID to the request header. The department guarantees idempotency on the business system side, preventing double processing caused by network retries. In the case of employee C's transfer event, the department executes the permission deletion task for the business system and the permission granting task for the development system using parallel threads. In the event of any task failure, the department automatically issues a compensating transaction based on the Saga pattern. The department rolls back the processing of successful tasks to maintain overall system consistency. During permission consistency checks, the department calculates the hash value of the permission lists obtained from each system. The automated account permission management unit compares the calculated hash value with the hash value of the permission list that represents the correct answer. This unit only performs detailed differential comparison processing if the hash values ​​are inconsistent. As a result of this technology, the automated account permission management unit minimizes the execution time of permission change processing with complex dependencies through task scheduling based on a directed acyclic graph. By using hash value consistency checks, the unit significantly reduces the CPU cycles required for comparison operations, completing checks on tens of thousands of accounts within seconds.In a specific application area, this system is used as a dynamic configuration system for developer access permissions in large-scale EC websites consisting of hundreds of independent microservice groups.

[0053] The Generative AI Execution Department, within the Account Permission Automation Management Department, utilizes generative AI to analyze, assess, and optimize various types of information. For example, it comprehensively analyzes employee roles, business content, departments, past permission history, system usage history, organizational permission hierarchy, security policies, past data on missed deletions or incorrect permission granting, audit trails, external threat information, and legal compliance requirements. When deleting an employee's account, it learns past deletion patterns and system dependencies, automatically targeting and prioritizing the deletion of systems with high deletion risks. During transfers, it analyzes the employee's business content and the permission requirements of both the old and new departments, automatically generating optimal permission granting / deletion steps. When an employee works across multiple projects, generative AI analyzes the system usage and permission history of each project, optimizing account deletion and permission revocation upon departure on a project-by-project basis. If an employee is temporarily granted managerial permissions, it automatically revoks those permissions to ensure no unnecessary managerial privileges remain after a transfer. When employees utilize multiple cloud platforms and external services, generative AI, via API linkage, performs account deletion and permission changes across all external services simultaneously, preventing omissions in deletions and errors in permission granting. In the event of an urgent employee departure, generative AI can also instantly lock all system accounts and automatically send alerts prompting managers to take immediate action. Specific examples of prompts that generative AI can read include: "Employee X has left the company. Prioritize deleting accounts from all business systems previously used by X, focusing on systems with a high risk of omissions, and record the deletion results in the audit log department"; "Employee Y has transferred from the sales department to the development department. Analyze Y's business content and the permission requirements of the old and new departments to generate the best steps for deleting unnecessary permissions and granting necessary ones"; "Employee Z works across multiple projects. Analyze Z's system usage across projects to optimize account deletion and permission revocation upon departure on a project-by-project basis"; and "Learn from past cases of omissions in deletions or errors in permission granting to automatically optimize future account management procedures," etc. Specifically, the generative AI execution unit uses a few-shot prompting technique to control a large language model. At the beginning of the input prompt, the generative AI execution unit configures several input-output pairs of past successful permission changes. It then appends current event information as context. The generative AI execution unit tokenizes the prompt string and inputs it into the model's context window. As specific examples of input data, firstly, there exists a tokenized sequence of natural language: "An employee X's departure event has occurred. All accounts of specific X in the past used by all business systems are prioritized for deletion, prioritizing systems with a high risk of omission, and the deletion results are recorded in the audit log department." Secondly, there exists a vector representation of employee X's past system access logs.Third, a numerical matrix representing the ease of deletion for each system exists. The generative AI execution unit, in the model's decoder layer, autoregressively predicts the next label, generating an output sequence. Specific examples of the output data include: first, a JSON array containing a list of system IDs that should be prioritized for deletion; second, strings representing deletion commands for each system; and third, text representing log messages to be sent to the audit log department. The generative AI execution unit passes the output JSON array to the subsequent command execution module. This module parses the JSON array, generates and sends API requests in a specified order. If the model's output probability is below a certain threshold, the generative AI execution unit determines that the risk of hallucination is high. It then pauses automatic execution and branches the process to a workflow requiring manager approval. As an effect of this technology, the generative AI execution unit achieves high inference accuracy for unknown system structures and complex operational patterns through few-shot hints and without model relearning. By using branching based on output confidence, the generative AI execution unit proactively prevents fatal system failures caused by AI misjudgments. In specific application areas, this system is used as an intelligent permission transfer system in central provincial departments and large-scale autonomous entities that frequently undergo organizational restructuring and whose permission rules are easily complicated.

[0054] The User Interface Department provides dashboards and user interfaces that allow managers and HR personnel to monitor each employee's account management status, generative AI-based risk assessment results, alerts, and audit logs in real time via a web browser or dedicated application. For example, managers can request account locking and grant exceptional permissions in emergencies from the terminal. They can also manually register employee transfers and departures from the terminal, triggering immediate account management actions. Audit reports can be downloaded and submitted to external auditors and management. The department also provides educational manuals, tutorial videos, and automated FAQ generation. Specifically, the User Interface Department uses the GraphQL protocol for data communication with the server. It sends queries defining the necessary data structure from the terminal to the server. It receives only plain JSON data from the server. The received data is cached in the browser's local storage or indexed database. In the event of a subsequent request for the same data, the user interface department retrieves the data from the cache without engaging in network communication. The user interface (UI) uses a data visualization library to dynamically render permission granting status and risk assessment results as ScalableVectorGraphics charts in the dashboard. In the manual event registration screen, the UI asynchronously calls the validation API the instant an input field loses focus. The UI verifies the appropriateness of input values ​​in real time and displays error messages instantly on the screen. In the FAQ auto-generation function, the UI sanitizes the HTML-formatted text data output from the generative AI execution unit. To prevent cross-site scripting attacks, the UI securely embeds malicious script tags into designated areas of the screen after excluding them. As a result of this technology, the UI minimizes network payload by employing GraphQL, achieving high-speed screen display even in bandwidth-constrained environments such as mobile lines. Through client-side caching control and asynchronous validation, the UI dramatically improves the user experience while reducing server load. Specifically, this system is utilized as a mobile-enabled management console for security administrators who need to perform emergency account suspension operations from a location using a smartphone or tablet.

[0055] The Audit Log Department records the history of all account management operations in chronological order, including account creation, deletion, permission changes, granting / revoking access permissions, API key issuance / expiration, and account locking / unlocking. It automatically generates reports for audit responses and internal controls. For example, it automatically generates dashboards that clearly show who granted / revoked which permissions and when. Upon detecting violations of security policy permission settings, it automatically suggests corrective measures and notifies administrators. When compliance requirements change, it proposes permission settings based on the new requirements, which can be automatically applied after administrator approval. The audit trail also integrates with external systems and cloud storage, enabling long-term storage and external audit responses. Specifically, the Audit Log Department uses a cryptographic hash function to hash received log data. It includes the hash value of the immediately preceding log data in the current log data and hashes it again. By repeating this process, it builds a hash chain, cryptographically ensuring the immutability of the log data. The Audit Log Department generates blocks summarizing log data over a specific period. The audit logging department configures the hash values ​​of each block in a Merkle tree structure and calculates the root hash. This root hash is periodically written to a smart contract on an external public blockchain network. Prompted by a corrective action plan, the audit logging department simulates the execution of corrective commands output from a generative AI execution unit in a temporary sandbox environment. After confirming that the simulation results do not compromise system stability, the audit logging department displays the corrective action plan on the administrator's screen. In conjunction with cloud storage, the audit logging department converts log data to columnar formats such as Parquet. After compressing the data, it asynchronously transmits it to object storage. As a result of this technology, the audit logging department, through the combination of hash chains and Merkle trees, makes log tampering caused by insider criminals and advanced cyberattacks mathematically impossible, maximizing the integrity of the audit trail. By storing data in columnar format, the audit logging department dramatically improves the execution speed of statistical queries on petabytes of log data and reduces storage costs. In a specific application area, this system is used by listed companies that comply with strict financial reporting requirements such as the SOX Act as an auditing platform to demonstrate the effectiveness of automated IT general controls.

[0056] The External System Integration Department is responsible for integrating with various internal and external business systems and services, including email systems, file sharing systems, groupware, project management systems, cloud infrastructure, customer management systems, expense settlement systems, attendance management systems, remote access systems, VPNs, network equipment, and physical access control systems. This integration utilizes APIs, batch processing, webhooks, SAML, and OAuth authentication mechanisms to automatically perform operations such as account creation, deletion, and permission changes. For example, it employs a structure that allows for easy integration with new business systems and external services through API integration and plugin additions. Integration with overseas branches and the group company, multilingual compatibility, time zone compatibility, and local regulatory compliance are also automatically optimized. In case of failure, it monitors the status of the integrated target system, automatically executes retries and alternative steps when processing fails, and notifies administrators. Specifically, this External System Integration Department functions as an identity provider based on the SecurityAssertionMarkupLanguage protocol. Upon receiving an authentication request from an external system, the department verifies the user's authentication status. Upon successful authentication, the external system linkage unit generates an XML-formatted assertion containing user attribute and permission information. This unit digitally signs the assertion using a private key and sends it to the external system. In linkages using the OAuth protocol, the unit generates a JSON Web Token. It stores the token's validity period and scope information in the token's payload and signs it using the HMAC algorithm. In batch-based linkages, the unit generates a CSV file and encrypts its transmission to an external file server using the SecureFileTransferProtocol. During status monitoring of the target system, the unit periodically sends HTTP GET requests to the health check API. It records response times and status codes and calculates moving averages to assess system robustness. As an alternative step in fault detection, in the event of a main API endpoint failure, the unit dynamically switches the request destination to a pre-defined backup endpoint. As a result of this technology, the external system linkage unit securely builds a single sign-on environment by eliminating the risk associated with individual system management passwords through the use of standardized authentication protocols. This external system linkage unit, through dynamic endpoint switching, localizes the impact of external system failures on the processing of this system, thereby improving overall fault tolerance. In a specific application area, this system is used as a configuration center in mid-to-small and medium-sized enterprises that utilize most SaaS applications in their business and wish to automate the allocation and revocation of licenses accompanying employee onboarding and offboarding.

[0057] Thus, the system described in this embodiment, through the coordinated operation of its various components, automates the management of all employee accounts, including those for business contracts, with high precision and efficiency. This simultaneously reduces security risks, lightens workload, strengthens governance, enhances audit response capabilities, cuts operating costs, ensures system scalability, and even provides educational and operational support. Specifically, this system executes each component as an independent process on the operating system. It minimizes data transfer overhead by utilizing shared memory and named pipes in inter-process communication. The system dynamically scales the number of worker threads based on the number of CPU cores on the server. During peak traffic periods, the system coordinates with the cloud environment's auto-scaling function to automatically increase or decrease the number of virtual machine instances. The system manages the database connection pool, eliminating latency required for connection establishment and termination. The system prevents memory leaks by periodically releasing unnecessary objects in memory through garbage collection. As a result of this technology, the system optimizes the utilization efficiency of hardware resources, maximizing transaction processing capacity per unit time. Through dynamic scaling, the system maintains responsiveness even during sudden surges in events, bringing downtime close to zero. In a specific application area, this system is used as a backend system for comprehensive management of internal employee permissions and access control for customer support in a consumer-facing web service with millions of users.

[0058] (Implementation steps) Step 1: Registration / Update of Personnel Information. The HR manager uses a web browser or dedicated application on a terminal to register or update detailed personnel information for all employees, including those on business contracts, full-time employees, temporary employees, and part-time employees. This information includes their name, employee number, start date, end date, transfer history, department, projects they were responsible for, position, contact information, qualifications, education history, past performance reviews, account access history, and system usage history, to the HR Information Management Department. For example, if employee A joined on April 1, 2024, transferred from the Sales Department to the Information Systems Department on June 1, 2024, and left on December 31, 2024, all these events are recorded chronologically, and the relevant business systems and access information for each event are also managed in a linked manner. Specifically, the terminal receives string data input by the HR manager. The terminal performs a client-side format check on the input data using regular expressions. The terminal serializes the checked data into a JSON payload. The terminal sends a POST request to the HR Information Management Department on the server using the HTTPS protocol. Upon receiving a request, the Human Resources Information Management Department deserializes the data within the payload. To prevent SQL injection attacks, the department performs escaping and cleansing processes on the input data. In cases containing confidential information such as passwords, the department hashes the data using the SHA256 algorithm after adding a salt. The department then initiates a database transaction. It issues INSERT or UPDATE SQL statements to the employee's basic information table, membership history table, and permission history table. After confirming that all SQL statements have been executed correctly, the department commits the transaction, making the data persistent. Finally, the department returns an HTTP response to the terminal containing a status code indicating the processing result. As a result of this technology, the system physically blocks the intrusion of illegal data through dual authentication on both the client and server sides, robustly protecting database consistency. Through transaction control, the system completely prevents inconsistent states where only a portion of the data is updated, even in the event of a failure during writes to multiple tables. In a specific application area, this system is used as a secure and high-speed personnel master data registration system in large retail chains where thousands of part-time employees are hired and leave every month.

[0059] Step 2: Detection of Personnel Events. The Event Detection Department monitors the HR Information Management Department's database in real time or at predetermined intervals, detecting events such as onboarding, offboarding, and transfers immediately. For example, it can automatically extract employees whose scheduled onboarding date is today and detect them as onboarding events, or automatically detect employees whose offboarding date is today and process them as offboarding events, or detect transfers as transfer events when the transfer date is today. When an event occurs, it automatically sends email notifications, chat notifications, push notifications, etc., to managers and relevant personnel to encourage confirmation and acknowledgment of the event content and the input of additional information. Specifically, the Event Detection Department performs periodic polling of the HR Information Management Department's database. The Event Detection Department monitors the database's update log. The Event Detection Department extracts differential data from the update log. The Event Detection Department stores the extracted differential data in a time-series database. The Event Detection Department determines the type of event from the differential data. The Event Detection Department generates an event object based on the determination result. This event object is a data structure containing an employee identifier, event category, date and time of occurrence, and related attributes. The Event Detection Department sends the generated event object to a message queue. This message queue is middleware used to implement asynchronous processing. The system transmits events to subsequent processing units via the message queue. Through this asynchronous communication, the system prevents processing delays even when a large number of events occur simultaneously. This system improves system availability. The event detection unit performs notification processing when an event occurs. The event detection unit retrieves the address information of the notification target from the database. The event detection unit dynamically generates notification content. The event detection unit sends emails using the SMTP protocol. The event detection unit sends notifications to the chat system using HTTP requests. The event detection unit sends requests to the push notification server. The system executes these notification processes in parallel threads. The system minimizes notification latency. The system supports rapid response from administrators. The system prevents omissions in the processing of personnel events. The system significantly improves the efficiency of personnel management in large-scale organizations.

[0060] Step 3: Automated Execution of Account Management Processing. Based on event information notified by the Event Detection Department, the Account Permission Automation Management Department automatically performs the following processes for multiple business systems: account creation, deletion, permission changes, password initialization, account locking, access restrictions, two-factor authentication settings, usage period settings, account activation / deactivation, group addition / deletion, role assignment, and API key issuance / deactivation. For example, during an onboarding event, the department automatically creates the necessary business system accounts based on the employee's department, position, and projects, issues initial passwords, and automatically adds the necessary permissions and groups. During a departure event, the department automatically deletes the corresponding employee's account from all business systems. For systems where deletion is not possible, the account is deactivated, access permissions are revoked, API keys and tokens are invalidated, and physical access is immediately suspended. During a transfer event, the department automatically deletes permissions from the old department, automatically assigns the necessary permissions to the new department, and automatically performs permission transfer on a project-by-project basis. Specifically, the Account Permission Automation Management Department receives event objects from the message queue. The department then parses the payload of the event object. The automated account permission management department extracts the identifier of the target employee. It uses the employee identifier as the key to retrieve information from the personnel database. It then obtains detailed attribute information about the employee. The department uses an attribute-driven provisioning rule engine. This engine maintains a tree structure of conditional branches in memory. It compares the employee's department and position with the conditional nodes. It retrieves a list of necessary system identifiers from consistent leaf nodes. The department initializes the API client for each system identifier. It sends HTTP POST or PUT requests to the RESTful APIs of various business systems. The request body includes parameters for account creation and permission changes. It verifies the response codes from each system. If the response code is normal, it logs successful processing. If the response code is incorrect, it performs a retry. It uses an exponential backoff algorithm to gradually increase the retry interval. This system improves fault tolerance to temporary network failures and overload of linked target systems through retry control. In the event of a departure, the account permission automatic management department uses a dependency graph to determine the deletion order. This department performs a topological sort of the dependency graph. Based on the sorting result, it sends account deletion requests sequentially, starting from the lowest-level systems. This order control prevents referential consistency errors between systems. The system completely eliminates the possibility of missed account deletions. This system significantly enhances the enterprise's security level.

[0061] Step 4: Optimization, Anomaly Handling, and Audit Support Based on Generative AI. In the automated account permission management process, the Generative AI Execution Department uses generative AI to comprehensively analyze employee roles, business content, departments, past permission history, system usage history, organizational permission hierarchy, security policies, past deletion omissions or permission granting errors, audit trails, external threat information, and legal compliance requirements. This enables the execution of optimal account management procedures and automatic anomaly handling and audit trail recording. For example, when deleting an employee's account, it learns past deletion omission patterns and system dependencies, automatically targeting and prioritizing the deletion of systems with high deletion risk. For example, during transfers, it analyzes the employee's business content and the permission requirements of the old and new departments, automatically generating optimal permission granting / deletion procedures. For example, when an employee works across multiple projects, generative AI analyzes the system usage and permission history of each project, optimizing account deletion and permission revocation upon departure on a project-by-project basis. Specific examples of prompts read by the generative AI could include: "Employee X has left the company. Prioritize deleting accounts from all business systems previously used by X, focusing on systems with a high risk of omission, and record the deletion results in the audit log department." "Employee Y has transferred from the sales department to the development department. Analyze Y's business content and the permission requirements of the old and new departments to generate the best steps for deleting unnecessary permissions and granting necessary ones." "Employee Z has worked across multiple projects. Analyze Z's system usage across projects to optimize account deletion and permission revocation upon departure on a project-by-project basis." "Learn from past cases of deletion omissions and permission granting errors to automatically optimize future account management steps," etc. Specifically, the generative AI execution unit drives a neural network containing a large-scale language model. This neural network employs a Transformer architecture with a self-attention mechanism. The generative AI execution unit receives employee data and system environment data from the account permission automatic management unit. It converts the received data into a natural language prompt string. The generative AI execution unit inputs the prompt string into a tokenizer. The tokenizer converts the string into a one-dimensional array of integer token IDs. The generative AI execution unit inputs an array of token IDs into an embedding layer. This embedding layer transforms each token ID into a continuous vector of values ​​with hundreds of dimensions. The generative AI execution unit then inputs these vectors into multi-layered encoder and decoder blocks. The neural network repeats matrix multiplication operations and applies non-linear activation functions in each layer. The neural network computes the contextual dependencies of the input data in a high-dimensional space. The neural network, as the output of the final layer, generates a probability distribution for the next token. The generative AI execution unit selects the token with the highest probability from this distribution. The generative AI execution unit repeats this autoregressive generation process to construct the output string.This generative AI execution unit parses the output strings as structured data. For example, input data for a resignation event includes a time-series array of the employee's past access logs, a list of identifiers used by the system, and text data from the organization's security policy document. The generative AI execution unit calculates a score for each system to remove any missed risks from this input data. It then identifies systems whose risk scores exceed a threshold. The generative AI execution unit generates a list of identified systems as output data. For example, input data for a transfer event includes a two-dimensional array representing the permission matrix of the old and new departments, and text data describing the employee's business activities. The generative AI execution unit generates a differential list of permissions to be added and permissions to be deleted from this input data as output data. The account permission automation management unit receives this output data. It then executes the actual API calls according to the steps described in the output data. This system, through AI-based dynamic parsing, solves complex permission dependencies that static rule-based systems cannot address. This system replaces the complex judgment process manually performed by human managers with computer computation. This system significantly improves the accuracy of permission settings. This system reduces the security risks caused by granting excessive permissions.

[0062] Step 5: User Interface-Based Management, Approval, and Auditing. The user interface provides dashboards and operation screens, allowing managers and HR personnel to check the account management status of each employee, generative AI-based risk assessment results, alarm notifications, audit trails, etc., in real time via a web browser or dedicated application. Managers can apply for account locking and granting of exceptional permissions in emergencies from the terminal, and can also manually register employee transfers and departures, triggering account management processes immediately. Audit reports can also be downloaded and submitted to external auditors and management. Educational manuals, tutorial videos, and automatic FAQ generation functions are also provided. Specifically, the user interface functions as a web server hosting the front-end application. The user interface distributes a single-page application, composed of markup languages ​​and scripting languages, to client terminals. The client terminal's web browser executes the distributed application. The user interface establishes a persistent connection with the back-end API server using a bidirectional communication protocol. The user interface receives events and status changes occurring on the server side in real time via this bidirectional communication channel. The user interface updates the virtual document object model on the screen based on the received data. The user interface only applies differentials to the actual screen drawing tree. This system optimizes screen rendering performance through a differential update mechanism. The user interface displays various statistical information as graphs and charts on the dashboard screen. It visualizes the risk scores calculated by generative AI using color codes. The user interface highlights items with high risk scores in red. The user interface accepts input from administrators. When the emergency account lock button is pressed, the user interface immediately sends a control command to the backend. The backend server receives the control command and executes the invalidation of the target account as the highest priority interruption process. The user interface accepts requests to generate audit reports. It instructs the backend form generation engine to output data in document format or comma-separated format. The user interface allows client terminals to download the generated files. This system provides an intuitive and highly responsive operating environment. It reduces the cognitive load on administrators. It improves response speed in emergencies. This system makes a significant contribution to the efficiency of audit operations.

[0063] Step 6: Audit Logs, External System Integration, and Fault Response. The Audit Logs Department records the history of all account management operations in chronological order, including account creation, deletion, permission changes, granting / revoking access permissions, API key issuance / expiration, and account locking / unlocking. It automatically generates reports for audit response and internal control. The External System Integration Department integrates with various internal and external business systems and services, including email systems, file sharing systems, groupware, project management systems, cloud storage, customer management systems, expense settlement systems, attendance management systems, remote access systems, VPNs, network devices, and physical access control systems, through API, batch processing, Webhook, SAML, and OAuth authentication. This integration automatically executes account creation, deletion, and permission changes. In case of faults, it monitors the status of the integrated target system, automatically performs retries and alternative steps when processing fails, and notifies administrators. Specifically, the Audit Logs Department records all state transitions and operational events within the system as immutable log data. It applies cryptographic hash functions to each log entry and includes the hash value of the preceding log entry in the current log entry. The audit logging department uses a hash chain structure to make log data tampering mathematically detectable. It saves generated log data to an append-only storage area. The external system linkage department employs a microservice architecture. It runs independent adapter modules for each linked target system. It uses standard authorization protocols to execute authorization processes with external cloud services. It stores acquired access tokens in a secure key management system. It uses a markup language-based authentication protocol to establish single sign-on authentication linkage. When sending requests to external systems, it verifies the token's validity period. If a token expires, it automatically obtains a new access token using a refresh token. It provides an endpoint to receive callback requests from external systems. It verifies the signature of received payloads to confirm the legitimacy of the sending source. The system includes a fault detection module. This module periodically sends health check requests to each external system. It monitors response time and status codes. When an anomaly is detected, the fault detection module applies a circuit breaker pattern. This system temporarily blocks request transmission to the malfunctioning system. This system prevents cascading failures across the entire system. This system automatically performs failover when an alternative processing path exists. This system achieves high fault tolerance and availability. This system enables comprehensive access control in complex multi-cloud environments.

[0064] (specific use case) For example, imagine a telecommunications or IT-related company where contract employees participate in projects on a project-by-project basis, with frequent onboarding, transfers, and departures. In this scenario, the HR information management department would create a detailed database of contract employees' onboarding and departure dates, departments, projects, positions, past transfer history, system usage history, and access history. It would also manage the access permissions and scope of the business systems required for each project. For instance, if a contract employee is assigned to a project in the sales department, requiring accounts for multiple business systems such as the sales support system, customer management system, file sharing system, and groupware, when the HR manager registers an onboarding event, the event detection department would immediately detect the event. The account access control department would then automatically perform account creation, initial password issuance, automatic addition to necessary groups and roles, two-factor authentication settings, and usage period settings for the sales department's business systems via API linkage. Furthermore, the generative AI execution department analyzes the business content of the employee in the business contract, the history of permission settings for similar past projects, security policies, and the hierarchical structure of permissions within the organization, automatically generating the optimal permission assignment pattern and judging to prevent the assignment of unnecessary permissions and excessive access permissions. Specifically, this system uses a graph database to manage dynamic permission allocation on a project-by-project basis. The HR information management department stores employee nodes, project nodes, and system permission nodes as a graph structure. The HR information management department defines the relationships between nodes as edges. The event detection department detects assignment events to new projects. The event detection department forwards the assignment event data to the automatic permission management department. The automatic permission management department issues an exploratory query to the graph database. The automatic permission management department extracts all system permission nodes connected to the target project node. Based on the extracted list of permission nodes, the automatic permission management department performs configuration processing to each business system in parallel. Before this configuration processing, the generative AI execution department verifies the appropriateness of the permissions. The generative AI execution department generates a time-series vector representing the target employee's past project history. The generative AI execution department generates a feature vector representing the security requirements of the current project. The generative AI execution unit feeds these vectors into a neural network. This neural network uses a multilayer perceptron to compute the inner product of the vectors and perform nonlinear transformations. The neural network outputs a recommendation score for each permission. The generative AI execution unit then identifies permissions with recommendation scores below a predetermined threshold and excludes these specific permissions from the list of permissions to be granted. For example, the generative AI execution unit learns from data on similar projects that have experienced past data breaches. Based on this learning, the generative AI execution unit determines that external access to a specific file-sharing system is not required. This system overcomes the limitations of static role-based access control through this AI-based dynamic filtering. This system strictly applies the principle of least privilege.This system balances rapid project launch with a high level of security maintenance.

[0065] For example, when an employee is transferred from the sales department to the information systems department upon project completion, the event detection department detects the transfer event, and the account permission auto-management department automatically deletes permissions for the sales support system and customer management system, creates new accounts for the development support system, cloud platform, and project management system required by the information systems department, and automatically assigns appropriate administrator permissions and access permissions. The generative AI execution department comprehensively analyzes changes in business content and roles before and after the transfer, past transfer cases, system permission consistency, security risk assessment, etc., to automatically generate the optimal permission transfer steps to avoid permission duplication and contradictions. For example, when permission transfer needs to be done on a project-by-project basis, the generative AI analyzes the system utilization status and permission history of each project, automatically revoking permissions that become unnecessary after the transfer and only granting newly needed permissions. Specifically, the event detection department detects changes in department codes from the personnel database update log. The event detection department notifies the permission auto-management department of this change as a transfer event. The permission auto-management department retrieves the permission set related to the department before the transfer and the permission set related to the department after the transfer from the database. The automated permission management department calculates the logical difference between the permission sets of the two entities. It generates lists of permissions to be deleted and permissions to be added. The generative AI execution department optimizes this difference list. The generative AI execution department receives natural language text describing the employee's business content as input data. It uses a natural language processing model to extract business keywords and roles from the text. It compares the extracted features with the system's permission matrix. The generative AI execution department identifies exceptions to permissions that continue to be needed even after a transfer. For example, it detects from text parsing that specific customer response items continue even after a transfer from the sales department to the information systems department. The generative AI execution department generates output data recommending the retention of a portion of permissions in the customer management system. It returns this output data to the automated permission management department in a structured data format. The automated permission management department parses the structured data and determines the final configuration plan. Based on the determined plan, the automated permission management department sequentially executes API requests to each system. This system prevents business disruptions caused by excessive or insufficient permissions. It also eliminates security vulnerabilities caused by the residual effects of unnecessary permissions. Furthermore, it drastically reduces the workload of IT administrators during complex organizational changes.

[0066] In addition, in the event of a resignation, the Event Detection Department detects the arrival of the resignation date, and the Account Permission Automation Department automatically performs account deletion or invalidation, API key or token expiration, and suspension of physical access permissions for all business systems. The Generative AI Execution Department analyzes past cases of missed account deletions or incorrect permission granting, system dependencies, the resigner's system usage history, and external service integration status, prioritizing the deletion of systems with a high risk of omissions, and automatically recording the deletion results or anomaly handling in the Audit Log Department. For example, if the resigner has used multiple cloud platforms or external services, the Generative AI, via API linkage, performs account deletion or permission changes for all external services to prevent missed account deletions or incorrect permission granting. Furthermore, in the event of a sudden resignation decision, the Generative AI immediately locks all accounts in the system and automatically sends alerts prompting managers to take immediate action. Specifically, the Event Detection Department performs daily batch processing comparing the current date with the scheduled resignation date in the HR database. The Event Detection Department extracts records with matching dates. The Event Detection Department registers the extracted records as resignation events in a queue. The automated access control department retrieves resignation events from a queue. It collects all account identifiers associated with the target employee from a unified database. The generative AI execution department receives the collected list of accounts and a dependency graph of each system as input. It uses a graph neural network to calculate the importance of each node and its impact upon deletion. The generative AI execution department outputs a priority list for deletion, starting with systems with high impact. For example, it sorts the data so that accounts of authentication providers serving as the single sign-on platform are deleted last, while accounts of individual business applications are deleted first. The automated access control department calls the deletion API according to this priority list. It monitors the API response and, in case of deletion failure, immediately changes the account password to a random string, locking the account. In the event of a sudden resignation or disciplinary termination, the system bypasses normal sequential control. It asynchronously broadcasts an account invalidation command to the entire system. This emergency handling minimizes the risk of malicious internal misconduct or data escaping. This system fully automates the off-the-job processing and ensures the preservation of reliable audit trails. It strongly supports corporate compliance requirements.

[0067] In such use cases, specific examples of prompts that the generative AI can read include: "Employee X has left the company. Identify all accounts used by X in the past for all business systems, prioritize deleting accounts from systems with a high risk of omission, and record the deletion results in the audit log department," "Employee Y has transferred from the sales department to the information systems department. Analyze Y's business content and the permission requirements of the old and new departments, generate the best steps to delete unnecessary permissions and grant necessary permissions," "Employee Z works across multiple projects. Analyze the system usage of each of Z's projects, optimize the account deletion and permission revocation required upon departure on a project-by-project basis," and "Learn from past cases of missed account deletions or incorrect permission granting, automatically optimize future account management steps," etc. Specifically, the generative AI execution unit has a template engine that dynamically constructs these prompts. This template engine embeds specific variables in placeholders based on the type of event and the attributes of the target. The generative AI execution unit passes the constructed prompts to the input interface of a large-scale language model. This large-scale language model, in addition to pre-training, is fine-tuned using the company's proprietary account management manual or past event reports. This large-scale language model parses the context of the input prompt text through a self-attention mechanism. It calculates the correlation between the embedding vectors of each word. It compares past patterns of missing deletion cases with the current situation. It calculates a similarity score. If the similarity score exceeds a certain value, it generates a warning message specific to the system. As output, it generates structured data containing a list of specific commands to be executed or a set of parameters for an API request. This structured data is then passed to subsequent automated execution modules. This system seamlessly integrates flexible instructions based on natural language with rigorous program-based execution. It enables administrators to apply highly automated logic without writing complex scripts. This system significantly reduces the cost of system operation and maintenance.

[0068] Thus, the system of this invention automatically and optimally performs account creation, deletion, and permission changes across multiple business systems based on personnel events such as employee onboarding, transfers, and departures. By leveraging generative AI, it comprehensively analyzes past usage history, security policies, inter-system dependencies, changes in business content, and external service linkages, preventing omissions in account deletion or errors in permission granting. It achieves a high level of account management, including automatic recording of audit trails and emergency response. Specifically, the system functions as a unified platform tightly integrating event-driven architecture and machine learning models. The system is triggered by updates to the personnel database, chaining the activation of microservice groups. The system provides an abstraction layer that absorbs the differences in API specifications across various business systems. The system assembles a generative AI-based inference engine into a configured pipeline. This inference engine constructs a high-dimensional feature space from input attribute data or historical data. The inference engine performs clustering or classification tasks on the feature space. The inference engine probabilistically derives the optimal permission structure. Based on the inference result, the system executes deterministic system control. The system stores the complete history of state transitions in cryptographically protected data storage. This system performs access control with speed and accuracy that surpasses the limits of human cognitive abilities and manual operations through a series of processing loops. It simultaneously enhances the confidentiality, integrity, and availability of information security. In modern enterprise environments with large-scale and complex IT infrastructure, this system provides an indispensable security foundation. It brings about a revolutionary improvement in the self-discipline and reliability of computer technology itself.

[0069] (Application Example 1) The specific processing flow corresponding to Use Case 1 will be described below. The various parts of the system described below are implemented by the data processing device 12 and the intelligent device 14. Furthermore, the data processing device 12 is referred to as the "server" and the intelligent device 14 is referred to as the "terminal".

[0070] (Implementation methods for carrying out the present invention) Regarding the embodiments for implementing the present invention, a detailed description is given using an automated access control system in a data center as an example. The system in this embodiment adopts a structure including a personnel information management department, an event detection department, an automated access control department, a generative AI execution department, an audit log department, a user interface department, and an external system linkage department.

[0071] The Human Resources and Information Management Department centrally manages a database containing all attribute information for various personnel entering and exiting the data center, including names, facial photos, contact information, organizations, employment types, contract periods, scheduled entry and exit dates and times, job duties, responsible projects, past work history, past access history, past security incident history, educational history, qualification information, health check history, emergency contact information, and on-site supervisor information. For example, if external contractor A is scheduled to enter the data center from 9:00 AM to 5:00 PM on July 1, 2024, for server maintenance, the database records detailed information such as the worker's name, company, scheduled work date and time, job duties, past entry and exit history, previously granted permissions and their validity period, past security incident history, past educational attendance history, and whether they have a health check history. Furthermore, the database can comprehensively manage all work and access history even when the same person works on multiple projects or at multiple data center locations. For example, individuals with special duty assignments or access requirements, such as emergency responders or night shift workers, can have their attributes or history managed individually. Similarly, individuals like cleaners or equipment inspectors, who are only permitted access to designated areas or times, can have detailed entry / exit controls or access permissions set. Specifically, the personnel information management department constructs a hybrid data storage system combining relational databases and document-oriented databases. The department stores fixed data such as names or affiliations in relational tables. It stores non-fixed data, such as facial photographs or past work history, as documents. The department applies convolutional neural networks to the facial photograph data. It extracts facial feature points from the images, generating hundreds-dimensional feature vectors. These feature vectors are indexed and stored in a vector database. The system uses these feature vectors to perform high-speed and high-precision facial authentication upon entry. The department uses individual attribute information as nodes and relationships with projects or affiliated organizations as edges, unfolding a graph structure in memory. The Human Resources Information Management Department uses this graph structure to instantly retrieve lists of all operators belonging to a specific project, or sets of personnel with access rights to specific areas. For example, the system dynamically generates special access profiles for personnel marked as emergency response personnel, bypassing the usual approval process. For cleaners, the system sets logical partitions that restrict their access to server racks, granting them only passage rights to specific passageways during specific time periods. This system achieves these complex attribute managements through optimized data structures. The system flexibly adapts to the stringent access requirements of the data center.

[0072] The Event Detection Department monitors event information from the Human Resources Information Management Department and various systems, including the Work Schedule Management System, Physical Access Management System, Facial Recognition Gates, IC Card Readers, Biometric Authentication Devices, On-site Reception Terminals, Work Instruction Systems, and Emergency Notification Systems, in real-time or at predetermined intervals. This includes events such as entry, exit, changes in work content, emergency responses, malfunctions, temporary work permits, work interruptions, work extensions, and work cancellations. Events are detected immediately upon occurrence. For example, if external contractor A passes through the entry gate for server maintenance, the entry event is detected from the facial recognition log, IC card authentication log, or the operation history of the reception terminal. Similarly, if the work content changes mid-process from server maintenance to network equipment settings, the work change event is detected from the updated information in the Work Instruction System or the on-site supervisor's confirmation record. After work is completed, the exit event is detected from the logs of the Physical Access Management System. Finally, if temporary access is granted during a malfunction, the emergency entry event is detected from the Emergency Notification System or the on-site supervisor's confirmation record. For example, if a task finishes earlier than scheduled or is extended, the event is detected from updates in the schedule management system, triggering subsequent processing. Specifically, the event detection unit receives streaming data from various sensors and authentication devices configured within the data center. It uses a distributed messaging system to handle high-throughput data streams. The unit parses frame data from camera images sent from the facial recognition gate in real time. It calculates the cosine similarity between the facial feature vector extracted from the frame data and the feature vector stored in the personnel information management department. If the similarity exceeds a threshold, it generates an event object indicating successful identity verification. The unit decodes the serial numbers of wireless tags read from IC card readers. It compares the serial numbers with records in the database to generate an entry event. It applies change data capture technology to the task instruction system's database. It monitors transaction logs to detect updates to task content in real time. It groups related events from multiple sources by time range. It uses a composite event processing engine to infer meaningful business events from combinations of simple events. For example, in the event detection department, if a series of events occur, such as the passage through an entrance door and the unlocking of a specific server rack, these are integrated as maintenance operation start events. Through this high level of event processing, the system accurately maps the physical space's status to the digital space. This system endows the computer system with real-time status awareness.

[0073] Based on event information notified by the Event Detection Department, the Automatic Access Management Department automatically performs actions on all systems within the data center, including the Physical Access Management System, Surveillance Camera Management System, Network Equipment Management System, Server Management System, Configuration Management System, Power Management System, Facility Monitoring System, Cloud Disk Management System, Storage Management System, Backup Management System, Security Monitoring System, Access Log Management System, VPN Management System, Remote Access Management System, and API Management System. These actions include account creation, deletion, permission granting / revocation / modification, access restrictions, account locking, API key issuance / expiration, usage period setting, two-factor authentication setting, access scope restriction, operation log retrieval setting, and alarm notification setting. For example, for operators entering the site for server maintenance, automatic access permissions are granted, including physical access to the server room, unlocking of corresponding racks, access to the server management console, viewing of surveillance camera footage, necessary network equipment configuration modification permissions, operation permissions for the power management system, and viewing permissions for the facility monitoring system. Furthermore, if the work content is changed, unnecessary permissions are immediately revoked, and only newly required permissions are granted. For example, in the event of an exit incident, the permissions of the relevant personnel are immediately revoked from all related systems, and their accounts are invalidated or deleted. For example, to prevent duplicate or conflicting permissions across multiple sites or systems, permission consistency checks are automatically implemented. For example, for API management systems or remote access management systems, temporary API keys or VPN accounts are automatically issued for the duration of the operation and can be immediately invalidated after the operation ends. For example, for backup management systems or storage management systems, access scopes or operation permissions are meticulously set for specific projects or operation content to prevent access to unwanted data or accidental operations. Specifically, this automated permission management department installs a dynamic policy evaluation engine based on the principles of a zero-trust architecture. When receiving an event object from the event detection department, the automated permission management department collects the current context information of the object. This context information includes location information, time frame, device security status, and network path. The automated permission management department inputs the context information and the requested access permissions into the policy engine. The policy engine uses an attribute-based access control model to determine the permission granted through logical operations. If access is granted, the automated permission management department dynamically generates a configuration script for the target system. This automated access control unit uses an encrypted communication protocol to establish a secure communication channel with the target's server or network device. It executes generated scripts on the target device to create local accounts or add firewall rules. For API management systems, it generates temporary access tokens in the form of signed tokens. The unit embeds the job end time as the validity period into the token's payload.This automated access control system defines the list of endpoints accessible by the token as a scope. By using this cryptographically signed token, the system enables access verification within a distributed system without queries to a central server. Upon receiving a job completion event, the system immediately updates the token invalidation list and sends a command to the controller to invalidate physical door access permissions. This system achieves seamless and strict access control across physical and logical boundaries.

[0074] In the automatic access control department, the generative AI execution unit comprehensively analyzes all relevant information, including the operator's job content, past work history, security policies, access requirements of various systems, on-site risk level, deletion of missing or incorrectly granted access data, external threat information, legal compliance requirements, audit trails, organizational access hierarchy, past incident response history, on-site supervisor's approval history, operator's educational or qualification information, and health diagnosis history. It autonomously determines and executes the optimal access control set or anomaly handling, automatically records audit trails, and provides immediate emergency response. For example, inputting a prompt like, "Operator B has entered the site for network equipment setup work. Considering B's past work history, current security policies, network equipment management system access requirements, on-site risk level, B's educational or qualification information, and past incident response history, propose the optimal access control set," into the generative AI, the AI ​​automatically generates the necessary minimum and appropriate access control set. For example, in the event of an exit incident, a prompt such as "An exit incident has occurred for Operator C. Identify all system permissions granted to C today, prioritize revoking permissions for systems with a high risk of omission, and record the audit trail" is used. The AI ​​considers past omission cases, system dependencies, on-site risk levels, and external threat information to ensure effective permission revocation. For example, if the work content is changed midway, a prompt such as "Operator D's work content has changed from server maintenance to network settings" is used. Considering D's new work content, past work history, security policies, network device management system permission requirements, D's educational history or qualification information, unnecessary permissions are deleted, and necessary permissions are added. The AI ​​recalculates the optimal permission set, and the automatic permission management department updates the permissions of each system in real time. For example, in emergency response or failure situations, based on the on-site supervisor's approval or information from the emergency notification system, the AI ​​automatically determines temporary permission granting or access scope expansion and executes immediate permission revocation after the work is completed. Specifically, this generative AI execution unit runs on a parallel computing cluster hosting a large-scale language model corresponding to multimodal inputs. This generative AI execution unit receives not only text data but also time-series arrays of image tensors from surveillance cameras or network traffic as input. It projects this heterogeneous data into a common latent space vector. Using the Transformer's self-attention mechanism, it computes the complex relationships between the operator's attributes, past history, and current context. For example, it tokenizes the input prompt text, generating embedding vectors for each token. It then combines vector representations of similar cases retrieved from a past event database as context for the prompt. Finally, it uses this expanded context to perform inference.As output, this generative AI execution unit generates structured data containing a list of permissions to be granted, the validity period of each permission, and risk assessment scores. For example, in the event of a change in job content, the generative AI execution unit analyzes the differences between the job procedure text before and after the change. The generative AI execution unit specifies the range of newly required port numbers or IP addresses. The generative AI execution unit automatically generates firewall configuration change commands. In emergencies, the generative AI execution unit immediately begins inference triggered by an alert signal from an anomaly detection model. Within milliseconds, the generative AI execution unit calculates network isolation steps to minimize damage or grants temporary privileged access to the emergency response team and instructs the automated access control unit to execute them. This system eliminates human judgment delays through AI-driven dynamic control. This system maximizes security and agility in data center operations.

[0075] The Audit Records Department records the history of all account management operations in chronological order, including account creation, deletion, permission changes, granting / revoking of access permissions, API key issuance / expiration, account locking / unlocking, access logs, operation logs, alarm notifications, anomaly handling, and emergency response history. It automatically generates reports for audit responses or internal controls. For example, it automatically generates dashboards that clearly show who granted / deleted what permissions, when, which field manager approved what for which operator, which system the account deletion omission or permission granting error occurred in, and what anomaly handling or emergency response was performed. For example, when a violation of security policy permission settings is detected, it automatically suggests corrective actions and notifies management. For example, when legal compliance requirements are changed, it proposes permission settings based on the new requirements, which can be automatically applied after management approval. For example, it automatically generates audit reports or track data for reporting to external auditors or management, and can encrypt or permanently store the data, or link it to external storage as needed. Specifically, the Audit Records Department constructs immutable data storage using distributed ledger technology. The audit log department packages all account operation events occurring within the system as transactions. It aggregates multiple transactions to generate blocks. Using a cryptographic hash function, it includes the hash value of the previous block in the header of the current block. Through this blockchain structure, the audit log department mathematically makes tampering or deletion of past audit logs impossible. It performs real-time streaming processing on the recorded log data. It uses anomaly detection algorithms to score behaviors that deviate from normal operating patterns. When a score exceeds a threshold, it triggers an alert indicating the likelihood of a security incident. It periodically analyzes accumulated log data to construct a multi-dimensional data cube. Using this data cube, it generates audit reports at high speed from any angle. During report generation, it automatically applies data anonymization or masking. It complies with legal requirements such as the Personal Information Protection Act. It encrypts the generated report files using public-key cryptography. The encrypted files are asynchronously transmitted to object storage in the cloud to meet long-term storage requirements. The system provides complete transparency and traceability. It dramatically reduces the burden of proof for external audits.

[0076] The user interface (UI) provides dashboards or operation screens, allowing managers or site supervisors to monitor the account management status of each operator, as well as generative AI-based risk assessment results, alarm notifications, audit trails, operation history, anomaly handling history, and emergency response history in real time via a web browser or dedicated application. For example, managers can request account locking or granting of exceptional permissions in emergencies from the terminal. They can also manually register work content changes or exit events from the terminal, triggering immediate account management processing. Audit reports can be downloaded and submitted to external auditors or management. Educational operation manuals, tutorial videos, and automatic FAQ generation are also provided. For example, site supervisors can check operators' health diagnosis history or qualification information, and warnings can be displayed if necessary education or qualifications are lacking. Specifically, the UI provides a single-page application built using a modern front-end framework. The UI maintains a bidirectional communication connection with the back-end server, receiving push notifications of status changes in milliseconds. The UI reflects the received data stream in the in-memory state management store. The UI detects status changes to reconstruct the virtual screen tree and instructs differential rendering to the browser's rendering engine. This user interface (UI) depicts the floor plan of the data center as a 3D graphic. It displays the location information or permission status of each operator as a real-time overlay icon on the map. It visualizes the risk score calculated by generative AI as a heatmap. When a manager clicks a specific icon, the UI displays detailed attribute information or operation history of that operator in a modal window. The UI has a dedicated component for receiving emergency account lockout commands. This component displays a two-factor authentication prompt to prevent accidental operation. The UI sends the entered authentication code to the backend, triggering immediate execution. The UI includes a conversational interface using natural language processing. This conversational interface parses the text of questions from the on-site supervisor, extracts the best answer from the knowledge database, and displays it. Through advanced information visualization technology, the system enables an intuitive understanding of complex permission statuses. The system strongly supports the manager's decision-making.

[0077] The External System Integration Department, through API, batch processing, Webhook, SAML, OAuth, and other authentication methods, integrates with various internal and external business systems and services, including physical access control systems, surveillance camera management systems, network device management systems, server management systems, configuration management systems, power management systems, facility monitoring systems, cloud disk management systems, storage management systems, backup management systems, security monitoring systems, access log management systems, VPN management systems, remote access management systems, and API management systems. It automatically performs operations such as account creation, deletion, and permission changes. For example, even when new business systems or external services are added, a structure that allows for easy integration via API integration or plugins is employed. Integration with multiple branches or group companies, multilingual support, time zone compatibility, and compliance with local laws and regulations are also automatically optimized. For example, in the event of a failure, the status of the integrated target system is monitored, and retry or alternative steps are automatically executed when processing fails, with notification to administrators. For example, when an external contractor's contract expires or their qualifications become invalid, permissions are automatically revoked from all relevant systems, and the account is invalidated. Specifically, this External System Integration Department functions as an API gateway that extends the concept of an enterprise service bus. This external system linkage unit manages a group of adapters used to absorb differences in communication protocols or data formats between various linked target systems. This unit supports multiple communication protocols. When sending a request to an external system, the unit dynamically converts the payload data structure into the mode required by the target system. It executes standard authorization code procedures to securely obtain access to external cloud services. The unit maintains the obtained access token in an encrypted cache in memory. It detects timeouts caused by network interruptions or external system overload. In the event of an error, it automatically executes retry processing using an exponential backoff algorithm. If a predetermined number of retries fail, the unit moves the message to a backoff queue. It asynchronously notifies the administrator of alerts. It coordinates with external threat intelligence services through a callback mechanism. Upon receiving an attack indicator targeting a specific IP address or account, it immediately commands to terminate multicast sessions on all relevant adapters and invalidate the account. This robust linkage mechanism ensures transaction consistency in a heterogeneous environment. This system maximizes overall fault tolerance and security response speed.

[0078] As described above, the embodiments of this invention are linked to all entry / exit and operational events in the data center. Based on generative AI analysis, they automatically optimize and manage both physical and logical access permissions, simultaneously achieving reduced security risks, increased operational efficiency, prevention of human error, automatic recording of audit trails, immediate response in emergencies, cost reduction, system scalability assurance, education and operational support, legal compliance, external audit response, on-site security assurance, reduced burden on on-site personnel, increased efficiency of external contractor management, improved fault response capabilities, homogenization of operational quality, and even standardization of on-site operations. Specifically, this system functions as a cyber-physical system that comprehensively processes sensor data from the physical space and access logs from the logical space. This system combines an event-driven asynchronous processing pipeline with a high-level inference engine using a large-scale language model. The system mathematically derives the optimal permission configuration from the input multi-dimensional context data. Through a microservice architecture, the system instantly applies the derived permission configuration to dozens to hundreds of heterogeneous system clusters. Human intervention is completely eliminated in this series of processes. This system addresses the fundamental issue of setup errors or judgment delays caused by manual operations through computer technology. It ensures data integrity by utilizing blockchain technology in its audit logs. Through this combination of technologies, the system dynamically and rigorously applies the principle of least privilege in the extremely secure environment of a data center. This system minimizes the risk of unauthorized access. It significantly reduces the workload of administrators and promotes efficient use of computer resources. This system achieves a level of security and operational efficiency optimization that is unattainable with existing methods.

[0079] (System Composition) The system involved in this implementation includes a Human Resources Information Management Department, an Event Detection Department, an Automatic Access Control Department, a Generative AI Execution Department, an Audit Recording Department, a User Interface Department, and an External System Linkage Department. The Human Resources Information Management Department of this system will centrally database and manage all attribute information of data entry and exit personnel, including names, facial photos, contact information, organizations, employment types, contract periods, scheduled entry and exit dates and times, job duties, responsible projects, past work history, past access history, past security incident history, educational history, qualification information, health check history, emergency contact information, and on-site supervisor information. For example, when an external contractor enters the site for server maintenance, the system will record in detail the worker's name, company, scheduled work date and time, job duties, past entry and exit history, previously granted permissions and their validity periods, past security incident history, educational attendance history, and whether they have undergone a health check. For example, even when the same person works on multiple projects or at multiple data center sites, all work history and access history can be managed comprehensively. For example, for personnel with special duty types or access requirements, such as emergency responders or night shift workers, attributes or history can be managed individually. For example, for personnel like cleaners or equipment inspectors who are only permitted to access specific areas or time slots, detailed entry / exit controls or access permissions can be set. Specifically, this system deploys each processing unit as an independent process in memory space, using inter-process communication to achieve high-speed data linkage. This personnel information management unit adopts a distributed relational database management system. It distributes and stores tens of thousands of personnel attribute records across multiple storage nodes. Each record is assigned a unique hash value. This hash value enables distributed data configuration and high-speed retrieval. Large volumes of binary data, such as facial photos or biometric data, are stored in object storage. The personnel information management unit associates these reference identifiers with records in the database. The Human Resources Information Management Department stores past work history and access control history in a time-series database. The department uses timestamps as primary keys to build indexes. Through this optimized data structure, the system ensures millisecond-level response time for high-frequency read requests from the Event Detection Department or the Automatic Access Control Department. For example, the system starts a background process as the scheduled entry time for an external contractor approaches. The system pre-fetches the target's past security incident history or educational attendance history in memory. At the moment the actual entry event occurs, the system performs access control assessment instantly without disk read latency.This system leverages data management technology to handle massive access requests in large-scale data centers with zero latency. It prevents congestion at physical entrances, achieving both smooth entry and exit and rigorous security checks.

[0080] The Event Detection Department monitors event information from the Human Resources Information Management Department and various systems, including the Work Schedule Management System, Physical Access Management System, Facial Recognition Gates, IC Card Readers, Biometric Authentication Devices, On-site Reception Terminals, Work Instruction Systems, and Emergency Notification Systems, in real-time or at predetermined intervals. This includes events such as entry, exit, changes in work content, emergency responses, malfunctions, temporary work permits, work interruptions, work extensions, and work cancellations. Events are detected immediately upon occurrence. For example, if an external contractor passes through the entrance gate for server maintenance, the entry event is detected from facial recognition logs, IC card authentication logs, or the operation history of the reception terminal. Similarly, if the work content changes mid-process from server maintenance to network equipment settings, the work change event is detected from updated information in the Work Instruction System or the on-site supervisor's confirmation record. After work is completed, the exit event is detected from the logs of the Physical Access Management System. Finally, if temporary access is granted during a malfunction, an emergency entry event is detected from the Emergency Notification System or the on-site supervisor's confirmation record. For example, if a task finishes earlier than scheduled, or conversely, is extended, the event is detected from the update information of the schedule management system, triggering subsequent processing. Specifically, the event detection unit obtains raw data sent from various edge devices and linkage systems as time-series numerical vectors. The event detection unit performs denoising and normalization preprocessing on the obtained raw data. The event detection unit converts the preprocessed data into multidimensional tensors. The event detection unit stores the converted multidimensional tensors in a queue in memory. The event detection unit segments the data stream stored in the queue at regular time windows. The event detection unit inputs the segmented data blocks into the feature extraction module. The feature extraction module uses a convolutional neural network to extract spatial features. The feature extraction module uses a long short-term memory network to extract temporal features. The event detection unit inputs the extracted feature vectors into an anomaly detection algorithm. The anomaly detection algorithm calculates the Mahalanobis distance and scores the deviation from the normal state. If the calculated score exceeds a pre-set threshold, the event detection unit determines that a state transition event has occurred. The event detection unit classifies the event category based on the determination result. The event detection unit generates structured data containing labels representing the categorized event types and the time of occurrence. This unit uses an asynchronous communication protocol to send the generated structured data to the subsequent automated access control unit. By employing vector operations in this high-dimensional space, the system accurately captures minute state changes that are missed by simple rule-based threshold judgments. This processing significantly improves the accuracy of event detection. The system reduces false detections to prevent wasted computational resources in subsequent processing. This system demonstrates exceptional technical effectiveness in use cases such as access control in data centers or worker movement monitoring in large-scale factories.

[0081] Based on event information notified by the Event Detection Department, the Automatic Access Management Department automatically performs actions on all systems within the data center, including the Physical Access Management System, Surveillance Camera Management System, Network Equipment Management System, Server Management System, Configuration Management System, Power Management System, Facility Monitoring System, Cloud Disk Management System, Storage Management System, Backup Management System, Security Monitoring System, Access Log Management System, VPN Management System, Remote Access Management System, and API Management System. These actions include account creation, deletion, permission granting / revocation / modification, access restrictions, account locking, API key issuance / expiration, usage period setting, two-factor authentication setting, access scope restriction, operation log retrieval setting, and alarm notification setting. For example, for operators entering the site for server maintenance, automatic access permissions are granted, including physical access to the server room, unlocking of corresponding racks, access to the server management console, viewing of surveillance camera footage, necessary network equipment configuration modification permissions, operation permissions for the power management system, and viewing permissions for the facility monitoring system. Furthermore, if the work content is changed, unnecessary permissions are immediately revoked, and only newly required permissions are granted. For example, upon the occurrence of an exit event, the permissions of the relevant personnel are immediately revoked from all related systems, and the accounts are invalidated or deleted. For example, to prevent duplicate or conflicting permissions across multiple locations or systems, permission consistency checks are automatically implemented. For example, for API management systems or remote access management systems, temporary API keys or VPN accounts limited to the job period can be automatically issued and immediately invalidated upon job completion. For example, for backup management systems or storage management systems, access scopes or operation permissions are meticulously set according to specific projects or job content to prevent access to unwanted data or accidental operations. Specifically, the automatic permission management unit extracts the target user's identifier and event category from the received structured data. The automatic permission management unit uses the extracted identifier as a key to perform a query on the distributed database. The automatic permission management unit obtains a state vector representing the target user's current permission status. The automatic permission management unit loads the permission change template corresponding to the event category into memory. The automatic permission management unit performs matrix operations on the state vector and the permission change template. The automatic permission management unit calculates the difference vector between the permissions to be added and the permissions to be deleted through this matrix operation. The automated access control unit converts the calculated difference vector into an API request format that can be interpreted by each target system. It then uses parallel processing threads to asynchronously send the converted API requests to each system. The unit monitors the response status codes from each system. Upon receiving normal responses from all systems, the unit updates the status vector in the distributed database. In the event of communication errors or timeouts, the unit performs retry processing using an exponential backoff algorithm.This automated access control system performs a rollback to prevent inconsistencies in permissions when the retries reach their limit. It employs a non-traditional method of managing permission states in a vector space and calculating differences through matrix operations. This method enables the system to handle permission changes for systems of thousands of nodes in milliseconds. The system completely eliminates errors in permission settings caused by human intervention. In use cases such as zero-trust network environments or dynamic access control in large-scale cloud infrastructures, this system delivers a significant reduction in the cost of maintaining and utilizing security levels.

[0082] In the automatic access control department, the generative AI execution unit comprehensively analyzes all relevant information, including the operator's job content, past work history, security policies, access requirements of various systems, on-site risk level, deletion of missing or incorrectly granted access data, external threat information, legal compliance requirements, audit trails, organizational access hierarchy, past incident response history, on-site responsibility personnel's admission history, operator's educational or qualification information, and health diagnosis history. It autonomously determines and executes the optimal access control set or anomaly handling, automatically records audit trails, and provides immediate emergency response. For example, inputting a prompt like, "Operator B enters the site to configure network equipment. Considering B's past work history, current security policies, network equipment management system access requirements, on-site risk level, B's educational or qualification information, and past incident response history, propose the optimal access control set," into the generative AI will automatically generate the necessary minimum and appropriate access control set. For example, in the event of an exit incident, a prompt such as "An exit incident has occurred for Operator C. All system permissions granted to C today will be revoked, prioritizing the removal of permissions for systems with a high risk of omission, and the audit trail will be recorded" is used. The AI ​​considers past cases of omissions, system dependencies, on-site risk levels, and external threat information to ensure effective permission removal. For example, if the work content is changed midway, a prompt such as "Operator D's work content has changed from server maintenance to network settings" is used. Considering D's new work content, past work history, security policies, network device management system permission requirements, D's educational history or qualification information, unnecessary permissions will be removed, and necessary permissions will be added" is used. The AI ​​recalculates the optimal permission set, and the automatic permission management department updates the permissions of each system in real time. For example, in emergency response or when a failure occurs, based on the on-site responsible person's confirmation or information from the emergency notification system, the AI ​​automatically determines temporary permission grants or access scope expansions and executes permission removal immediately after the work is completed. Specifically, this generative AI execution unit contains a neural network based on a Transformer architecture built on a large-scale language model. The generative AI execution unit receives input data as a sequence of natural language text. It uses a tokenizer to convert the text sequence into a high-dimensional embedding vector. For example, it generates a 512-dimensional numerical vector representing operator attributes, past event history, and the current system state as input data. This input vector is fed into multiple encoder layers with a self-attention mechanism. The neural network calculates the contextual dependencies between the tokens and updates the hidden state vector. The decoder layer outputs a probability distribution representing the optimal permission composition. The generative AI execution unit selects the combination of permissions with the highest scores from the output probability distribution. This selected permission set is output as structured data.The generative AI execution unit, for example, outputs flags representing the granting of read permissions to system A, flags representing the revocation of write permissions to system B, and floating-point numbers between 0 and 1 representing their execution priorities. This output data is forwarded to the subsequent automatic permission management unit. The automatic permission management unit dynamically reorders the processing queue based on the priorities represented by the floating-point numbers. The neural network is pre-learned using a large dataset containing past permission setting errors or event cases. The neural network uses a cross-entropy error function to optimize the weight parameters in a way that minimizes the error between the predicted value and the correct answer label. By using this advanced inferential model, the system can instantaneously derive optimal solutions even for unknown situations or permission requests with complex dependencies that cannot be addressed in a static rule-based approach. This process eliminates security risks caused by excessive permission granting. In use cases such as access control in the backbone systems of financial institutions or research facilities handling confidential information, this system provides crucial technical effects of preventing information leakage and ensuring business continuity.

[0083] The audit log department records the history of all account management operations in chronological order, including account creation, deletion, permission changes, granting / revoking of access permissions, API key issuance / expiration, account locking / unlocking, access logs, operation logs, alarm notifications, anomaly handling, and emergency response history. It automatically generates reports for audit responses or internal controls. For example, it automatically generates dashboards that clearly show who granted / deleted what permissions, when, which on-site supervisor approved which operator, which system experienced account deletion omissions or permission granting errors, and what anomaly handling or emergency response was performed. For example, it automatically prompts corrective actions and notifies administrators when security policy violations are detected. For example, it proposes new permission settings based on changes to compliance requirements, which can be automatically applied after administrator approval. For example, it automatically generates audit reports or tracking data for reporting to external auditors or management, and can encrypt or permanently store data, or link to external storage as needed. Specifically, the audit log department asynchronously receives all transaction data occurring within the system via an event-driven architecture. The audit log department applies a hash function to the received transaction data to generate a digital signature to prevent tampering. It then stores the digitally signed data in an append-only distributed ledger database. The audit log department performs semantic parsing using a natural language processing model on the massive amount of stored log data. It extracts entities from the log data and maps them as nodes and edges onto a graph database. It then performs PageRank or community extraction algorithms on the graph database. These algorithms automatically detect anomalous patterns of permission migrations or potential security risks. The audit log department aggregates the detected risk information as a multidimensional array. It inputs the aggregated data into a visualization engine to generate dynamic dashboards. Upon receiving a report generation request, the audit log department extracts relevant records from the database based on a specified period and range. It then inputs the extracted records into a natural language generation model. This model converts numerical data or symbolic information into human-understandable summary text. Finally, the audit log department automatically generates an audit report that combines the summary text and statistical graphs. This system combines distributed ledger technology and graph parsing to rapidly clarify complex relationships while ensuring log integrity. Through this unconventional data processing method, it significantly reduces the computational resources and time required for auditing. In use cases such as internal control audits of listed companies or the maintenance of international security standard certifications, this system delivers the technological benefits of automated compliance and stricter tracking management.

[0084] The user interface (UI) provides dashboards or operation screens, allowing managers or site supervisors to monitor the account management status of each operator, as well as generative AI-based risk assessment results, alarm notifications, audit trails, operation history, anomaly handling history, and emergency response history in real time via a web browser or dedicated application. For example, managers can request account locking or granting of exceptional permissions in emergencies from the terminal. They can also manually register work content changes or exit events from the terminal, triggering immediate account management processing. Audit reports can be downloaded and submitted to external auditors or management. Educational operation manuals, tutorial videos, and automatic FAQ generation are also provided. For example, site supervisors can check operators' health diagnosis history or qualification information, and warnings can be displayed if necessary education or qualifications are lacking. Specifically, the UI operates as a single-page application built using a front-end framework. The UI establishes a constant connection with the back-end server using a bidirectional communication protocol. The UI receives push notifications whenever a status change occurs on the server side. The UI parses the received payload and redraws only specific components of the screen by updating the virtual document object model. The user interface unit captures user input events and validates the input data. It then sends the validated data to the server as a stateless API request. The user interface unit includes a rendering engine for visualizing generative AI-based risk assessment results as heatmaps or radar charts. This engine converts multi-dimensional assessment scores into two-dimensional pixel data. The user interface unit temporarily stores the user's operation history in local storage. When the network is disconnected, the user interface unit switches to offline mode and synchronizes cached operation logs to the server upon reconnection. This system eliminates the need for complete screen re-reading by employing an asynchronous communication architecture that combines a virtual document object model and bidirectional communication. This process minimizes network bandwidth consumption while achieving millisecond-level response performance. In use cases such as large-scale monitoring centers or system administrator terminals in remote office environments, this system effectively eliminates operational latency and significantly improves user experience.

[0085] The External System Integration Department integrates with various business systems and external services both inside and outside the company, including physical access control systems, surveillance camera management systems, network device management systems, server management systems, configuration management systems, power management systems, facility monitoring systems, cloud disk management systems, storage management systems, backup management systems, security monitoring systems, access log management systems, VPN management systems, remote access management systems, and API management systems, through API authentication methods such as API integration, batch processing, webhooking, SAML, and OAuth. This integration automatically performs operations such as account creation, deletion, and permission changes. For example, even when new business systems or external services are added, a structure that allows for easy integration via API integration or plugins is employed. Integration with multiple branches or group companies, multilingual support, time zone compatibility, and compliance with local laws and regulations are also automatically optimized. For example, in the event of a failure, the status of the integrated target system is monitored, and retry or alternative steps are automatically executed when processing fails, with notifications to administrators. For example, when an external contractor's contract expires or their qualifications become invalid, permissions are automatically revoked from all relevant systems, and the account is invalidated. Specifically, this External System Integration Department is installed as a separate container cluster based on a microservices architecture. The external system linkage unit dynamically loads adapter modules specialized for each linked target system. This unit inputs its internal standardized data model into each adapter module. The adapter module converts the standard data model into the inherent data format required by the linked target system. The unit uses the converted data to generate a communication request. It assigns an access token obtained using an authentication protocol to the request header. The unit sends the request via an encrypted communication path. It parses the response code returned from the target system. Upon receiving a response indicating that a rate limit has been reached, the unit dynamically adjusts the transmission interval using a token bucket algorithm. The unit incorporates a circuit breaker mode, temporarily blocking request transmission to that system upon detecting consecutive communication errors. During the blocking, the unit backs off requests to a message queue, asynchronously resuming processing after system recovery. This advanced flow control and fault isolation mechanism is autonomously executed within the computer. This process prevents a single external system failure from impacting the entire system. In use cases such as comprehensive management of multi-cloud environments or application of IT infrastructure in global enterprises, this system brings the extremely important technical effect of improving overall system availability and enhancing fault tolerance.

[0086] Specific examples of prompts that the generative AI needs to read when implementing this invention include: "Operator B enters the site for network equipment setup work. Considering B's past work history, current security policy, network equipment management system permission requirements, on-site risk level, B's educational history and qualification information, and past incident response history, propose the best set of permissions," "Operator C has left the site. Identify all system permissions granted to C today, prioritize deleting permissions from systems with high risk of omission, and record the audit trail," "Operator D's work content changes from server maintenance to network setup. Considering D's new work content, past work history, security policy, network equipment management system permission requirements, D's educational history and qualification information, delete unnecessary permissions, and add necessary permissions," "In emergency situations or when a failure occurs, based on the on-site supervisor's approval or emergency notification system information, automatically determine temporary permission grants or access scope expansions, and execute immediate permission deprivation after the work is completed," etc. Specifically, this system does not treat these natural language-based prompts as simple strings, but manages them internally as structured prompt templates. This system binds dynamic variables extracted from the database to placeholders within a template. The bound text data is then input into a token segmenter, converting it into a list of token identifiers as integer arrays. This token identifier list is then fed into the input layer of a large-scale language model. The large-scale language model applies a self-attention mechanism to the input token sequence, calculating the semantic distance between words in a multi-dimensional vector space. For example, for the phrase "high risk of deletion omission," the large-scale language model dynamically assigns high-weighting coefficients based on past event data. The calculated hidden state vectors are input into a fully connected layer and a Softmax function. The large-scale language model calculates the probability distribution of the tokens to be output next. The system uses a beam search algorithm to generate the token sequence with the highest probability. The system uses a decoder to inversely convert the generated token sequence back into natural language text or structured data. The system extracts parameters from the output structured data, including the system identifier, operation category, and validity period of the permission-granted object. These extracted parameters are then passed to the subsequent API call module. This system automates the entire process from prompt generation to model inference and result parsing. This system overcomes the limitations of traditional script processing, which relies on manual descriptive branching by human operators, through its unconventional approach. It achieves dynamic access control based on an understanding of complex contexts. In use cases such as unmanned operations in highly secure data centers or agile development environments with frequently changing tasks, this system drastically reduces application load and completely eliminates configuration errors.

[0087] (Implementation steps) Step 1: Registration / Update of Operator Information. The Human Resources and Information Management Department will centrally manage and database all attribute information of operators, maintenance workers, external contractors, security officers, cleaners, equipment inspectors, temporary workers, and night workers entering and leaving the data center. This includes their names, facial photos, contact information, organization, employment type, contract period, scheduled entry and exit dates and times, job duties, responsible projects, past work history, past access history, past security incident history, education history, qualification information, health check history, emergency contact information, and on-site supervisor information. For example, when an external contractor enters the site for server maintenance, detailed records will be kept of the operator's name, company, scheduled work date and time, job duties, past entry and exit history, previously granted permissions and their validity period, past security incident history, education history, and whether they have a health check. Specifically, the Human Resources and Information Management Department will store the diverse attribute information entered into a standardized set of tables in a relational database. For unstructured data such as facial photos, the Human Resources Information Management Department performs feature extraction processing using convolutional neural networks. The extracted facial features are converted into 512-dimensional floating-point vectors. These feature vectors are then indexed and stored in a vector database. For text data, the department performs morphological parsing and named entity extraction. The extracted keywords are used to construct an inverted index. Upon receiving registration and update requests, the department uses an exclusive control mechanism to ensure the atomicity, consistency, isolation, and durability of transactions. Upon completion of the update process, an event message containing the changed content is published to the message broker. This system employs a hybrid database architecture that comprehensively manages both structured and unstructured data. Through this processing, the system reduces the data retrieval speed in subsequent authentication or permission determination processes to logarithmic time complexity. This system delivers the technical benefits of maintaining data consistency and dramatically improving retrieval performance in use cases such as data center management for large cloud service providers with frequent personnel access, or access control for critical infrastructure requiring strict identity verification.

[0088] Step 2: Event Detection and Job Event Specificity. The event detection unit monitors event information from the Human Resources Information Management Department, Job Schedule Management System, Physical Access Management System, Facial Recognition Gates, IC Card Readers, Biometric Authentication Devices, On-site Reception Terminals, Job Instruction Systems, Emergency Notification Systems, etc., in real time or at predetermined intervals, including entry, exit, job content changes, emergency responses, malfunctions, temporary work permits, job interruptions, job extensions, and job cancellations, and detects events immediately upon occurrence. For example, when an external contractor passes through the entry gate for server maintenance, the entry event is detected from facial recognition logs, IC card authentication logs, and the operation history of the reception terminal. Specifically, the event detection unit continuously receives binary data streams containing biometric authentication data or IC card serial numbers sent from various sensors and terminals. The event detection unit decodes the received binary data and converts it into a structured record containing timestamps, device identifiers, and authentication scores. The event detection unit acquires the feature vector of the facial image sent from the facial recognition gate. The event detection unit calculates the cosine similarity between the acquired feature vector and a reference vector pre-registered in the vector database. The event detection unit determines that the individuals are the same person if the calculated similarity exceeds a predetermined threshold. It inputs relevant logs from multiple devices within a short period into a composite event processing engine. This engine analyzes the sequence and correlation of events within a time window. For example, it only identifies successful IC card touch and facial authentication events as legitimate entry events if they occur consecutively within 2 seconds. The event detection unit assigns a unique transaction identifier to each identified event. It then writes the event data to a memory data grid and triggers a notification to subsequent modules. This system utilizes sensor fusion technology to comprehensively evaluate data from multiple sensors in a high-dimensional space. Through this unconventional processing method, the system mathematically eliminates false detections caused by malfunctions or spoofing attacks from a single sensor. In use cases requiring high physical security, such as military facilities or server rooms of financial institutions, this system maximizes authentication accuracy and completely prevents unauthorized intrusion.

[0089] Step 3: Optimization / Determination of Permission Sets Based on Generative AI. In the automatic permission management process, the generative AI execution unit comprehensively analyzes all relevant information, including the operator's job content, past work history, security policies, access requirements of various systems, on-site risk level, deletion of omitted or incorrectly granted permission data, external threat information, legal compliance requirements, audit trails, organizational permission hierarchy, past incident response history, on-site supervisor's approval history, operator's educational history and qualifications, and health diagnosis history. It autonomously determines and executes the optimal permission set or anomaly handling, automatic recording of audit trails, and immediate response in emergencies. For example, inputting a prompt such as "Operator B enters the site for network equipment setup work. Considering B's past work history, current security policies, network equipment management system permission requirements, on-site risk level, B's educational history and qualifications, and past incident response history, propose the optimal permission set" into the generative AI, the AI ​​automatically generates the necessary minimum and appropriate permission set. Specifically, the generative AI execution unit supplies the input prompt and related contextual data to the input layer of the natural language processing model. The generative AI execution unit uses past access logs of operators as context data, formatting them into time-series tensors. It represents security policies as a set of nodes and edges in a knowledge graph. A multimodal encoder maps this heterogeneous data into a common latent space vector. A neural network uses the self-attention mechanism of a Transformer architecture to compute hidden correlations between job content and the permission requirements of each system. The neural network learns by assembling a penalty function based on past event data into a loss function. Using the learned weight parameters, the neural network calculates a risk score for each permission granted. The generative AI execution unit uses a search algorithm to identify combinations of permissions with risk scores below a tolerance threshold and the minimum required for job execution. It outputs the identified permission set as an array containing the target system identifier, operation permission level, and validity period. For example, as output data, it generates a command object that grants a 2-hour restriction on setting change permissions for router A. The generative AI execution unit then sends the generated output data to the subsequent automatic permission management unit. This system uses deep learning models to solve optimization problems with complex constraints in a nonlinear space. Through this processing, it can complete permission design within milliseconds, a process that would take human administrators tens of minutes. In use cases such as dynamic restructuring of large-scale IT infrastructure or rapid switching of access control upon event occurrence, this system delivers a significant leap in computational efficiency and demonstrates the strict application of the principle of least privilege.

[0090] Step 4: Permission granting / revoking / modifying performed by the Automatic Permission Management Department. Based on the optimal permission set determined by the Generative AI Execution Department, the Automatic Permission Management Department automatically performs the following processing for all systems within the data center: physical access control system, surveillance camera management system, network device management system, server management system, configuration management system, power management system, facility monitoring system, cloud disk management system, storage management system, backup management system, security monitoring system, access log management system, VPN management system, remote access management system, and API management system. Specifically, the Automatic Permission Management Department parses the array data received from the Generative AI Execution Department to generate individual task objects for each target system. The Automatic Permission Management Department enqueues the generated task objects into a distributed task queue. The Automatic Permission Management Department initiates multiple worker processes to asynchronously dequeue tasks from the queue. These worker processes serialize the payload according to the target system's API specifications. These worker processes use encrypted communication to send update requests to the target system's endpoints. This worker process monitors status codes from the target system. If the status code indicates a normal status, the process is considered successful and updates the permission status flags in the internal database. If the worker process receives an error response due to network latency or temporary system downtime, it uses an exponential backoff algorithm with jitter to schedule retransmission. The automated permission management department submits a series of transactions after confirming all tasks are completed. In the event of a fatal error during processing, the automated permission management department issues compensatory transactions to roll back the applied permission changes. This system achieves simultaneous parallel permission changes for hundreds of heterogeneous systems by employing a distributed queue and asynchronous worker model. This unconventional approach eliminates communication bottlenecks between systems, maximizing throughput. In use cases such as simultaneous account updates during company-wide personnel changes or immediate system-wide blocking upon detection of a network attack, this system demonstrates a significant improvement in processing speed and maintains complete consistency of system state.

[0091] Step 5: Audit Logs / User Interface-Based Management / External System Integration. The Audit Logs Department records the history of all account management operations in chronological order, including account creation, deletion, permission changes, granting / revoking access permissions, API key issuance / expiration, account locking / unlocking, access logs, operation logs, alarm notifications, anomaly handling, and emergency response history. It also automatically generates reports for audit responses or internal controls. The User Interface Department provides dashboards or operation screens, allowing managers or field supervisors to monitor the account management status of each operator or the results of generative AI-based risk assessments, alarm notifications, audit tracks, operation history, anomaly handling history, and emergency response history in real time via a web browser or dedicated application. The External System Integration Department integrates with various internal and external business systems and services, including the Physical Access Control System, Surveillance Camera Management System, Network Equipment Management System, Server Management System, Configuration Management System, Power Management System, Facility Monitoring System, Cloud Disk Management System, Storage Management System, Backup Management System, Security Monitoring System, Access Log Management System, VPN Management System, Remote Access Management System, and API Management System. This integration is achieved through API or batch processing, Webhook, SAML, OAuth, and other authentication mechanisms, automatically executing operations such as account creation, deletion, and permission changes. Specifically, the Audit Log Department uses a stream processing engine to aggregate execution logs output from the Automatic Permission Management Department in real time. The Audit Log Department then writes the aggregated log data along with hash values ​​into an immutable distributed ledger. This process mathematically makes data tampering impossible. The User Interface Department issues queries to backend endpoints. It stores the acquired data, which has a complex hierarchical structure, in a state management container on the client-side memory. The User Interface Department detects state changes and responsively updates screen elements. It also sends state change requests based on administrator actions as mutations to the server. This external system integration unit utilizes a service mesh architecture in its communication with external services. It automatically performs traffic routing, encryption, and observability metric collection via a sidecar agent. The unit dynamically generates authentication tokens, establishing a secure cross-domain authentication and authorization process. This system uses an event-driven architecture to loosely couple these independent modules. This structure enables independent scaling of each component. In use cases such as unified IT infrastructures for globally deployed multinational corporations or hybrid cloud environments spanning multiple cloud providers, this system delivers significantly improved overall system scalability and a substantial reduction in operational and maintenance costs.

[0092] (specific use case) For example, when an externally contracted maintenance worker enters the data center for server maintenance, the Human Resources Information Management Department creates and manages a detailed database containing the worker's name, facial photo, company affiliation, contract period, health check history, educational history, qualifications, past work history, past access history, emergency contact information, and on-site supervisor information. The Event Detection Department monitors entry events in real time from the work schedule management system, physical access control system, facial recognition gates, IC card readers, etc. Upon confirmation of the worker's entry, the Automatic Access Management Department automatically grants the necessary minimum and appropriate permissions corresponding to the work content, including physical access to the server room, unlocking of corresponding racks, access to the server management console, viewing of surveillance camera footage, permission to modify network equipment settings, operation of the power management system, and viewing of the facility monitoring system. The generative AI execution unit comprehensively analyzes the operator's past work history, current security policies, access requirements of various systems, on-site risk level, educational background and qualification information, and past incident response history. For example, inputting a prompt such as "Operator A has entered the site for server maintenance work. Considering A's past work history, security policies, server management system permission requirements, on-site risk level, A's educational background and qualification information, propose the optimal permission set" into the generative AI, the AI ​​automatically generates the necessary permission set. If the work content changes midway to network device configuration, the event detection unit detects the work change event. The generative AI execution unit uses a prompt such as "Operator A's work content has changed from server maintenance to network configuration. Considering A's new work content, past work history, security policies, network device management system permission requirements, A's educational background and qualification information, delete unnecessary permissions and add necessary permissions" to recalculate the optimal permission set. The automatic permission management unit immediately revokes unnecessary server management system permissions and grants necessary network device management system permissions. After the work is completed and the operator passes through the exit gate, the event detection department detects the exit event. The generative AI execution department uses a prompt message such as "An exit event has occurred for operator A. Identify all system permissions granted to A today, prioritize revoking permissions for systems with a high risk of omissions, and record the audit trail." Considering past omission cases, system dependencies, on-site risk levels, and external threat information, the department ensures the correct permission revocation. The audit logging department records all permission granting / revocation / change history chronologically and automatically generates reports for audit responses or internal controls. Furthermore, in emergency situations or in the event of a malfunction, based on the on-site supervisor's acknowledgment or information from the emergency notification system, the generative AI execution department automatically determines temporary permission grants or expanded access scopes and executes immediate permission revocation upon completion of the work.For example, a prompt message could be used such as, "Operator B has entered the site urgently to handle a fault. Considering B's past incident handling history, the risk level of the site, and the approval information of the site supervisor, the necessary permissions are temporarily granted and immediately revoked after the operation is completed." In this way, the system of this invention links with all entry / exit / operation events in the data center, automatically optimizing and managing both physical and logical access permissions based on generative AI analysis. This simultaneously achieves reduced safety risks, increased operational efficiency, prevention of human error, automatic recording of audit trails, and immediate response in emergencies. Specifically, this system does not treat this series of business processes as a simple sequential script execution, but rather processes them internally as a dynamic orchestration based on state transition mechanics. The system maps the lifecycle from operator entry to exit as state nodes of a finite automaton onto memory. The system asynchronously routes event data to triggers for each state transition via a message queue. In the generative AI execution unit, the input prompt message is fed into the encoder layer of the natural language processing model and converted into a high-dimensional context vector. This system inputs the context vector into the decoder layer and outputs an execution plan containing the specific API call sequence for the target system group. For example, as output data, the system generates structured data containing the endpoints, communication methods, and payloads for calling the API that grants permissions to the server management system. The system then passes this execution plan to the parallel execution engine of the automatic permission management unit. This parallel execution engine executes API calls without dependencies simultaneously through multiple threads. In the event of an interruption, such as a change in job content or an emergency, the system safely suspends the currently executing transaction. The system inputs a new context vector into the generative AI execution unit, causing it to dynamically recalculate the execution plan. Based on the recalculated differential plan, the system performs the removal of unnecessary permissions and the granting of new permissions as atomic operations. The system appends all operation logs in real time to an audit database with a hash chain structure. This system employs an unconventional architecture that tightly integrates this high level of state management with inference based on deep learning models. Through this processing, the system enables access control in the logical space to follow the dynamic changes in the physical space with millisecond-level latency. This system does not intervene in human judgment and always maintains the optimal security state of system groups with complex dependencies. In use cases such as fully unmanned operation of mission-critical data centers or autonomous system recovery processes during disasters, this system achieves the ultimate technical effect of maximizing cost reduction and mathematically approaching zero probability of security incidents.

[0093] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires voice representing the user's input on the result of the specific processing. The control unit 46A sends the voice data representing the user's input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0094] Data generation model 58 is what is known as generative AI (Artificial Intelligence).

[0095] One example of data generation model 58 includes ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> Generative AI, etc.

[0096] The data generation model 58 is obtained by performing deep learning on a neural network. A prompt containing instructions is input to the data generation model 58, along with inference data such as speech data representing speech, text data representing text, and image data representing images (e.g., data from still images or moving images). The data generation model 58 infers the input inference data based on the instructions shown in the prompt and outputs the inference result in one or more data forms, such as speech data, text data, and image data. The data generation model 58 may include, for example, text generation AI, image generation AI, and multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specific processing unit 290 performs the aforementioned specific processing while using the data generation model 58. The data generation model 58 may also be a fine-tuned model to output inference results from prompts without instructions; in this case, the data generation model 58 can output inference results from prompts without instructions. The data processing device 12, etc., includes multiple data generation models 58, including AI other than generative AI. AI other than generative AI includes, but is not limited to, linear regression, logistic regression, decision trees, random forests, support vector machines (SVM), k-means clustering, convolutional neural networks (CNN), recurrent neural networks (RNN), generative adversarial networks (GAN), or Naive Bayes. Furthermore, AI can also act as an AI agent. Additionally, when the processing described above is performed by AI, this processing may be partially or entirely performed by AI, but is not limited to this example. Moreover, processing performed by AI, including generative AI, can be replaced by rule-based processing, and vice versa.

[0097] Furthermore, the processing performed by the aforementioned data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Additionally, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart device 14 or external devices, and the smart device 14 acquires or collects information required for processing from the data processing device 12 or external devices.

[0098] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the smart device 14.

[0099] [Second Implementation] Figure 3 An example of the configuration of the data processing system 210 according to the second embodiment is shown.

[0100] like Figure 3 As shown, the data processing system 210 includes a data processing device 12 and smart glasses 214. One example of the data processing device 12 is a server.

[0101] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0102] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the microphone 238, speaker 240, camera 42, and communication I / F 44 are also connected to the bus 52.

[0103] Microphone 238 receives instructions from user 20 by receiving the sounds emitted by user 20. Microphone 238 captures the sounds emitted by user 20, converts the captured sounds into speech data, and outputs it to processor 46. Speaker 240 outputs sound according to the instructions from processor 46.

[0104] Camera 42 is a small digital camera equipped with an optical system such as a lens, aperture and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, used to capture the area around user 20 (e.g., the shooting range defined by an angle of view equivalent to the field of vision of an average healthy person).

[0105] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for the transmission and reception of various information between processor 46 and processor 28 via network 54. The transmission and reception of various information between processor 46 and processor 28 using communication I / F 44 and 26 is performed in a secure state.

[0106] Figure 4 An example of the main functions of the data processing device 12 and the smart glasses 214 is shown. Figure 4 As shown, in the data processing device 12, specific processing is performed by the processor 28. The memory 32 stores a specific processing program 56.

[0107] The specific processing program 56 is an example of a "program" as disclosed herein. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0108] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the specific processing unit 290. The specific processing unit 290 can use the emotion-specific model 59 to infer the user's emotions and perform specific processing based on the user's emotions. The emotion inference function using the emotion-specific model 59 (emotion-specific function) includes various inferences and predictions related to the user's emotions, but is not limited to this example. Furthermore, emotion inference and prediction also include, for example, emotion analysis (analysis).

[0109] In the smart glasses 214, the processor 46 performs the receive / output processing. The memory 50 stores the receive / output program 60. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on the RAM 48. The receive / output processing is implemented by the processor 46 operating as a control unit 46A based on the receive / output program 60 executed on the RAM 48. Furthermore, the smart glasses 214 may also have the same data generation model and emotion-specific model as the data generation model 58 and the emotion-specific model 59, and use these models to perform the same processing as the specific processing unit 290.

[0110] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. Each part of the system described below is implemented by the data processing device 12 and the smart glasses 214. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0111] (Example 1) Since the specific processing flow is the same as that in Embodiment 1 described in the first embodiment above, the description is omitted.

[0112] (Application Example 1) Since the specific processing flow is the same as that in Application Example 1 described in the first embodiment above, the description is omitted.

[0113] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires voice representing the user's input on the specific processing result. The control unit 46A sends the voice data representing the user's input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0114] Furthermore, the processing performed by the aforementioned data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Additionally, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or external devices, and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or external devices.

[0115] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the smart glasses 214.

[0116] [Third Implementation] Figure 5 An example of the configuration of the data processing system 310 according to the third embodiment is shown.

[0117] like Figure 5 As shown, the data processing system 310 includes a data processing device 12 and a head-mounted terminal 314. An example of the data processing device 12 is a server.

[0118] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0119] The head-mounted terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the microphone 238, speaker 240, camera 42, display 343, and communication I / F 44 are also connected to the bus 52.

[0120] Microphone 238 receives instructions from user 20 by receiving the sounds emitted by user 20. Microphone 238 captures the sounds emitted by user 20, converts the captured sounds into speech data, and outputs it to processor 46. Speaker 240 outputs sound according to the instructions from processor 46.

[0121] Camera 42 is a small digital camera equipped with an optical system such as a lens, aperture and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, used to capture the area around user 20 (e.g., the shooting range defined by an angle of view equivalent to the field of vision of an average healthy person).

[0122] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for the transmission and reception of various information between processor 46 and processor 28 via network 54. The transmission and reception of various information between processor 46 and processor 28 using communication I / F 44 and 26 is performed in a secure state.

[0123] Figure 6 An example of the main functions of the data processing device 12 and the head-mounted terminal 314 is shown. Figure 6 As shown, in the data processing device 12, specific processing is performed by the processor 28. The memory 32 stores a specific processing program 56.

[0124] The specific processing program 56 is an example of a "program" as disclosed herein. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0125] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the specific processing unit 290.

[0126] In the head-mounted terminal 314, the processor 46 performs the receiving and output processing.

[0127] The memory 50 stores a receive / output program 60. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on the RAM 48. The receive / output processing is implemented by the processor 46 operating the control unit 46A based on the receive / output program 60 executed on the RAM 48.

[0128] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. Each part of the system described below is implemented by the data processing device 12 and the head-mounted terminal 314. In the following description, the data processing device 12 will be referred to as the "server" and the head-mounted terminal 314 will be referred to as the "terminal".

[0129] (Example 1) Since the specific processing flow is the same as that in Example 1 described in the first embodiment above, the description is omitted.

[0130] (Application Example 1) Since the specific processing flow is the same as that in Application Example 1 described in the first embodiment above, the description is omitted.

[0131] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the head-mounted terminal 314. In the head-mounted terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires voice representing the user's input on the specific processing result. The control unit 46A sends the voice data representing the user's input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0132] Furthermore, the processing performed by the aforementioned data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the head-mounted terminal 314, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the head-mounted terminal 314. Additionally, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the head-mounted terminal 314 or external devices, and the head-mounted terminal 314 acquires or collects information required for processing from the data processing device 12 or external devices.

[0133] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the head-mounted terminal 314.

[0134] [Fourth Implementation] Figure 7 An example of the configuration of the data processing system 410 according to the fourth embodiment is shown.

[0135] like Figure 7 As shown, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0136] The data processing apparatus 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" as understood in this disclosure. The computer 22 includes a processor 28, RAM 30, and memory 32. The processor 28, RAM 30, and memory 32 are connected to a bus 34. Furthermore, the database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. An example of the network 54 includes a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0137] Robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control object 443. Computer 36 includes a processor 46, RAM 48, and memory 50. The processor 46, RAM 48, and memory 50 are connected to a bus 52. Furthermore, the microphone 238, speaker 240, camera 42, control object 443, and communication I / F 44 are also connected to the bus 52.

[0138] Microphone 238 receives instructions from user 20 by receiving the sounds emitted by user 20. Microphone 238 captures the sounds emitted by user 20, converts the captured sounds into speech data, and outputs it to processor 46. Speaker 240 outputs sound according to the instructions from processor 46.

[0139] Camera 42 is a small digital camera equipped with an optical system such as a lens, aperture and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, used to capture the area around user 20 (e.g., the shooting range defined by an angle of view equivalent to the field of vision of an average healthy person).

[0140] Communication I / F 44 is connected to network 54. Communication I / F 44 and 26 are responsible for the transmission and reception of various information between processor 46 and processor 28 via network 54. The transmission and reception of various information between processor 46 and processor 28 using communication I / F 44 and 26 is performed in a secure state.

[0141] The controlled object 443 includes a display device, LEDs for the eyes, and motors for driving the arms, hands, and feet. The posture and movements of the robot 414 are controlled by controlling the motors for the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. In addition, facial expressions of the robot 414 can also be expressed by controlling the illumination state of the LEDs for the robot 414's eyes.

[0142] Figure 8 An example of the main functions of the data processing device 12 and the robot 414 is shown. For example... Figure 8 As shown, in the data processing device 12, specific processing is performed by the processor 28. The memory 32 stores a specific processing program 56.

[0143] The specific processing program 56 is an example of a "program" as disclosed herein. The processor 28 reads the specific processing program 56 from the memory 32 and executes the read specific processing program 56 on the RAM 30. Specific processing is implemented by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0144] The memory 32 stores a data generation model 58 and an emotion-specific model 59. The data generation model 58 and the emotion-specific model 59 are used by the specific processing unit 290.

[0145] In robot 414, the processor 46 performs the receive / output processing. The memory 50 stores the receive / output program 60. The processor 46 reads the receive / output program 60 from the memory 50 and executes the read receive / output program 60 on RAM 48. The receive / output processing is implemented by the processor 46 operating the control unit 46A based on the receive / output program 60 executed on RAM 48.

[0146] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. Each part of the system described below is implemented by the data processing device 12 and the robot 414. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 will be referred to as the "terminal".

[0147] (Example 1) Since the specific processing flow is the same as that in Example 1 described in the first embodiment above, the description is omitted.

[0148] (Application Example 1) Since the specific processing flow is the same as that in Application Example 1 described in the first embodiment above, the description is omitted.

[0149] The specific processing unit 290 sends the result of the specific processing obtained in Embodiment 1 or Application Example 1 described above to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires voice representing the user's input on the result of the specific processing. The control unit 46A sends the voice data representing the user's input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0150] Furthermore, the processing performed by the data processing system 10 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but it can also be executed jointly by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Additionally, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or external devices, and the robot 414 acquires or collects information required for processing from the data processing device 12 or external devices.

[0151] In the above embodiments, examples of specific processing performed by the data processing device 12 are given, but the technology disclosed herein is not limited to this, and specific processing may also be performed by the robot 414.

[0152] Furthermore, the emotion-specific model 59, serving as an emotion engine, can determine the user's emotion based on a specific mapping. Specifically, the emotion-specific model 59 can determine the user's emotion based on an emotion graph that serves as a specific mapping (see...). Figure 9 The robot's emotions can be determined by the emotion-specific model 59. In addition, the emotion-specific model 59 can also determine the robot's emotions in the same way, and the specific processing unit 290 can also perform specific processing using the robot's emotions.

[0153] Figure 9 This is a diagram representing an emotion map 400 that maps various emotions. In the emotion map 400, emotions are arranged radially from the center in concentric circles. The closer to the center of the concentric circles, the more primitive the emotion is. Further out on the concentric circles, emotions are arranged representing states or actions arising from mood. Emotion is a concept that includes both feelings and mental states. To the left of the concentric circles, emotions generated by reactions occurring in the brain are arranged roughly. To the right of the concentric circles, emotions guided by situational judgments are arranged roughly. Above and below the concentric circles, emotions generated by reactions occurring in the brain and guided by situational judgments are arranged roughly. Furthermore, the emotion of "pleasure" is arranged above the concentric circles, and the emotion of "unpleasantness" is arranged below. Thus, in the emotion map 400, various emotions are mapped according to the structure of emotion generation, while easily generated emotions are mapped nearby.

[0154] These emotions are distributed at the 3 o'clock position on the Emotion Chart 400, and usually fluctuate between peace and unease. In the right half of the Emotion Chart 400, because situational awareness is more dominant than internal feelings, it gives a sense of calm.

[0155] The inner side of the emotion diagram 400 represents the mind, and the outer side of the emotion diagram 400 represents actions. Therefore, the further you go to the outer side of the emotion diagram 400, the more the emotion can be seen (manifested in actions).

[0156] Here, human emotions are based on a balance of various factors such as posture and blood sugar levels. When these balances deviate from the ideal, it indicates unhappiness; when they approach the ideal, it indicates pleasure. In robots, cars, and motorcycles, emotions can also be created based on a balance of factors such as posture and remaining battery power. When these balances deviate from the ideal, it indicates unhappiness; when they approach the ideal, it indicates pleasure. Emotion maps can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Speech Emotion Recognition and Brain Physiological Signal Analysis Systems for Emotion, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). In the left half of the emotion map, emotions belonging to the "Reaction" domain, where sensation is dominant, are arranged. Furthermore, in the right half of the emotion map, emotions belonging to the "Situation" domain, where situational cognition is dominant, are arranged.

[0157] The emotion map defines two types of emotions that promote learning. One is a negative emotion located near the middle of "repentance" or "reflection" on the situation side. That is, when the robot experiences negative emotions such as "I never want to feel this way again" or "I never want to be scolded again." The other is a positive emotion located near "desire" on the response side. That is, when the robot experiences positive feelings such as "wanting more" or "wanting to know more."

[0158] The emotion-specific model 59 feeds user input into a pre-learned neural network to obtain emotion values ​​representing each emotion shown in the emotion graph 400, and determines the user's emotion. This neural network is pre-learned based on multiple learning data sets that combine user input with emotion values ​​representing each emotion shown in the emotion graph 400. Furthermore, this neural network is learned to... Figure 10 As shown in sentiment graph 900, nearby sentiment values ​​are similar to each other. Figure 10 Examples show how emotions such as "peace of mind," "stability," and "reassurance" can result in similar emotional values.

[0159] The above description primarily focuses on the functions of the data processing device 12 to illustrate the system disclosed herein. However, the system disclosed herein may not necessarily be implemented on a server. The system disclosed herein can be implemented as a general information processing system. For example, it can be implemented as a software program running on a personal computer, an application running on a smartphone, etc. The methods disclosed herein can be provided to users in the form of SaaS (Software as a Service).

[0160] In the above embodiments, an example of specific processing performed by a single computer 22 is given. However, the technology disclosed herein is not limited to this, and distributed processing of specific processes by multiple computers, including computer 22, is also possible. For example, the data generation model 58 may also be provided in an external device of the data processing apparatus 12, where data is generated based on input data.

[0161] In the above embodiments, an example of storing a specific processing program 56 in memory 32 is illustrated, but the technology disclosed herein is not limited thereto. For example, the specific processing program 56 may also be stored in a portable computer-readable non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 performs specific processing according to the specific processing program 56.

[0162] Alternatively, the specific processing program 56 can be stored in a storage device such as a server connected to the data processing device 12 via a network 54, and the specific processing program 56 can be downloaded and installed into the computer 22 upon request from the data processing device 12.

[0163] Furthermore, it is not necessary to store the entire specific process 56 in a storage device such as a server connected to the data processing device 12 via the network 54, nor is it necessary to store the entire specific process 56 in the memory 32; a portion of the specific process 56 may also be stored.

[0164] As a hardware resource for performing specific processing, various processors can be used. For example, a CPU can be listed as a processor; it is a general-purpose processor that functions as a hardware resource for performing specific processing by executing software, i.e., a program. Furthermore, as a processor, a dedicated circuit can be listed as a processor; it is a processor with a circuit structure specifically designed for performing specific processing, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit).

[0165] Every processor has built-in or connected memory, and every processor performs specific processes by using memory.

[0166] The hardware resources for performing a specific process can consist of one of these various processors, or a combination of two or more processors of the same or different types (e.g., a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Furthermore, the hardware resources for performing a specific process can also be a single processor.

[0167] As an example of a single processor, the first type consists of a combination of one or more CPUs and software, which functions as a hardware resource to perform specific processing. The second type uses a processor, such as a System-on-a-chip (SoC), which implements the entire system functionality, including multiple hardware resources performing specific processing, using a single IC chip. In this case, the specific processing is implemented using one or more of the aforementioned processors that serve as hardware resources.

[0168] Furthermore, as the hardware architecture of these various processors, more specifically, circuits combining semiconductor elements and other circuit components can be used. Moreover, the specific process described above is merely an example. Therefore, it goes without saying that, without departing from the main point, unnecessary steps can be removed, new steps can be added, or the processing order can be changed.

[0169] The foregoing descriptions and illustrations are detailed explanations of the parts covered by this disclosure and are merely one example of this disclosure. For instance, the descriptions of the above-described structure, function, role, and effect are just one example of the structure, function, role, and effect of the parts covered by this disclosure. Therefore, it goes without saying that, without departing from the spirit of this disclosure, unnecessary parts can be deleted, new elements can be added, or replacements can be made to the foregoing descriptions and illustrations. Furthermore, to avoid confusion and facilitate understanding of the parts covered by this disclosure, explanations of technical common sense that does not require special explanation for implementing this disclosure have been omitted from the foregoing descriptions and illustrations.

[0170] All documents, patent applications and technical standards described in this specification are incorporated herein by reference as if they were specifically and individually described as incorporated by reference.

[0171] In addition, the following notes further explain the above explanation.

[0172] (Note 1) A data center access control system includes a personnel information management department, an event detection department, an automatic access control department, and a generative AI execution department. The personnel information management department centrally manages the attribute information, entry and exit schedules, work content, affiliation, past work history, access history, and security policy compliance status of operation and maintenance managers, maintenance personnel, external contractors, and security officers entering and exiting the data center. The event detection department monitors and detects event information such as entry, exit, and work content changes from the personnel information management department and the work schedule management system in real time or at predetermined intervals. The automatic access control department, based on the events detected by the event detection department, manages the physical access control system, ... Multiple data center systems, including surveillance camera management systems, network device management systems, and configuration management systems, automatically perform tasks such as account creation, deletion, permission granting / revocation / modification, access restrictions, account locking, API key issuance / expiration, and usage period setting for relevant personnel. The generative AI execution unit, within the automatic permission management unit, analyzes the operator's work content, past work history, security policies, access requirements of various systems, on-site risk levels, deleted omissions or erroneous permission granting cases, and external threat information. Generative AI is used to autonomously determine and execute optimal permission sets or handle anomalies, automatically record audit trails, and provide immediate responses in emergencies.

[0173] (Note 2) As described in Appendix 1, the system is characterized in that, when an entry event occurs, the generative AI execution unit comprehensively analyzes the operator's work content, past work history, security policies, on-site risk level, access requirements of each system, and deletes missing or incorrect permission assignment case data, and automatically generates the necessary minimum and appropriate permission set in real time. Based on this, the automatic permission management unit automatically performs account creation and permission assignment for multiple systems in the data center.

[0174] (Note 3) As described in Appendix 1, the system is characterized in that, when an exit event or a change in work content occurs, the generative AI execution unit determines all permissions granted to the operator during the work period, analyzes past deletion omissions or permission residual risks, inter-system dependencies, audit trails, external threat information, etc., prioritizes depriving permissions of systems with high deletion omission risks, immediately deletes unnecessary permissions, grants new permissions when necessary, and automatically saves all processing results as audit records.

Claims

1. A system comprising a personnel information management department, an event detection department, an automatic account permission management department, and a generative AI execution department, characterized in that, The Human Resources Information Management Department centrally manages personnel event information, including employees with business contract agreements, such as onboarding, offboarding, and transfers; the Event Detection Department monitors and records personnel events in the Human Resources Information Management Department in real time or at predetermined intervals to detect event occurrences; the Account Permission Automatic Management Department automatically performs account creation, deletion, and permission changes for the employee across multiple business systems based on the events detected by the Event Detection Department. In the automatic account permission management process, the generative AI execution unit analyzes various information such as employee roles, business content, department, past permission history, and security policies. In order to autonomously determine and execute the best account permission settings, deletion steps, exception handling, and audit log generation, generative AI is used.

2. The system as described in claim 1, characterized in that, The generative AI execution unit learns from past cases of missed account deletions and incorrect permission assignments. When an employee leaves or is transferred, it automatically generates and executes the best account management steps to minimize the risks of missed deletions or incorrect permission assignments, taking into account the employee's business history, system usage, organizational permission hierarchy, and security risk assessment.

3. The system as described in claim 1, characterized in that, When personnel events such as onboarding, offboarding, and transfers occur, the automated account permission management department uses API linkage and batch processing to automatically execute account creation, deletion, and permission changes across multiple business systems. Furthermore, the generative AI execution department analyzes the access permission requirements, security policies, and changes in employee business content of each business system, and optimizes a series of account management processes as needed, including automatic generation of alert notifications to managers, automatic generation of anomaly handling procedures, and automatic recording of audit trails.

Images