1. A method for deploying a security layer for monitoring authorization-exceeding modifications performed by a user of services in a distributed network, said method comprising: a) providing between said user and said services said security layer having: 1) a role mapping component imparted with a current role mapping between said services and permissions comprising policies, groups, users; 2) a network authentication protocol for authenticating said user; b) deploying said network authentication protocol at a log-in time to authenticate said user; c) taking snapshots of a baseline role mapping and snapshots of a baseline membership mapping of said user in at least one organization unit at time intervals of the order of 5 minutes; d) storing said snapshots in a remote secured location accessible to said security layer via a secured sockets layer connection; e) comparing said current role mapping with said baseline role mapping and comparing a current membership mapping of said user with said baseline membership mapping when said user performs an action affecting said permissions; f) restoring said current membership mapping to said baseline membership mapping; whereby authorization-exceeding modifications by said user are monitored by said security layer.