1. A computer implemented method comprising: obtaining, by a computing device, a user list comprising a plurality of users and corresponding permission sets held by the plurality of users and not assigned to an existing role; and iteratively defining roles for the plurality of users, wherein iteratively defining the roles comprises the computing device: generating, from data in the user list, a matrix representation of similarities between the permissions sets for the plurality of users in the user list; generating, from the matrix representation of similarities, a cluster image for display to the user graphically indicating the similarities between the permissions sets of the plurality of users in the user list, wherein the cluster image comprises a cluster graphically representing a subset of users with at least one common permission; selecting the cluster corresponding to the subset of the users in the user list; creating a role for the subset of users represented by the selected cluster; assigning a permission shared by at least two users in the subset of users to the role; assigning the role to the subset of users represented by the selected cluster; and updating the user list for a subsequent iteration, wherein updating the user list comprises removing the permission assigned to the role from the permission sets of the subset of users represented by the selected cluster.