Permission Coverage Calculator

coverage = covered ÷ required, over-grant rate = extra ÷ (covered + extra), redundancy = duplicate grants ÷ covered. Coverage answers whether the role works at all; the over-grant rate answers whether it works too well. Redundancy is the third dimension — permissions arriving from several roles at once are the reason revoking one role often changes nothing.

A gap produces access-denied tickets on day one of a new joiner, while over-granting produces the audit finding six months later, and only measuring both at once lets you fix one without creating the other.

This calculator takes 4 inputs: Permissions the role needs, Permissions covered by current grants, Granted but not required, Permissions granted more than once. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because of redundant grants. When a permission arrives through three roles, two group memberships and one inline policy, removing any single source leaves the effective permission intact. Effective-permission tooling, not role membership, is the only reliable way to confirm a revoke landed.

Essentially 100% of the permissions the job requires, because the alternative is a person who cannot work. The number worth driving down is the over-grant rate: getting it under about 10% is a realistic target for a mature role model.