Duplicate Group Check

Access groups accumulate

Somebody needs a role slightly different from an existing one, so a new group is made by copying it. The difference turns out not to be needed, or gets solved another way, and nobody goes back.

A year later there are four groups granting exactly the same rights and nobody remembers which is the real one.

Each set of groups granting exactly the same rights, named against each other — and, listed apart, the groups that grant nothing.

That is not a tidiness problem

Every extra group is another thing to remember when access changes, another row in every review an auditor reads, and another place for the next person to put somebody by mistake — into the copy nobody maintains any more.

What it compares, said plainly

Each group's own access rights. Two groups reported as identical here may still differ through the groups they imply, which this does not resolve.

That is a real limitation and it is stated rather than glossed over, because a duplicate-finder you cannot trust is worse than none: it is the report that gets somebody's access removed.