Embodiments pertaining to managing access in one or more computing systems can include an operations controller in communication with the one or more computing systems for managing commercial transactions of the one or more computing systems and an access management controller in communication with the operations controller. The access management controller can receive an input that identifies relationships between user roles and actions associated with the one or more computing systems. The access management controller can provide the input to the operations controller for implementation of access rules in accordance with the relationships. The access management controller can attempt to access in the one or more computing systems at least a portion of the user roles and the actions after the operations controller has implemented the access rules. The access management controller can compare the attempted access with the relationships to determine access discrepancies.