Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to automatically detect inadvertent, unauthorized account access. For example, a user account may be analyzed to identify roles thereof that permit identities of other accounts to assume the roles of the user account. The analysis is performed for each identified account, including any accounts having roles that permit identities of further accounts to assume the roles of the identified accounts. Accordingly, a chain of roles may be determined that indicates how one account may have access to another account via one or more intervening role assignments. This circuitous path of account access may be represented and displayed to a user, e.g., via a tree structure. Upon identifying an unauthorized account, an appropriate action may be performed to adjust permissions.