1. A method in a host organization, the method comprising: receiving as input, a plurality of access requests for data stored within the host organization and a corresponding plurality of actions for the data to which access is requested; accessing an input table having a time field, action field, item field, and agent field therein; recording time data within the time field for each of the received plurality of access requests and the corresponding plurality of actions; recording time data and agent data for each of the received plurality of access requests and the corresponding plurality of actions based on the action performed on an item of the data to which access is requested; and analyzing the input table to generate one or more pairs of first actions and items to second actions and items and a time based score for each of the one or more pairs, wherein the time based score is dependent upon a time between the actions for each of the one or more pairs.