IDENTIFYING INCONSISTENT SECURITY POLICIES IN A COMPUTER CLUSTER

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for identifying inconsistent security policies. One of the methods includes identifying running software components on a cluster of computers, a first subset of the components managing datasets, a second subset of the components managing other components; identifying entity pairs, each being either: (1) (i) a component paired with (ii) a dataset, or (2) two components paired with each other; determining, for each entity pair, a directed relationship from a first to a second entity, where the first entity is a component, and where the directed relationship represents the first entity executing a type of interaction with the second entity; identifying security policies affecting each entity that each limit user access to a type of interaction; and analyzing, for each entity, entity pairs including the entity and one or more security policies affecting the entity to identify inconsistent security policies.