1. An enterprise system for automatically replacing a user security group-based computer security policy by a computer security policy based at least partially on actual access, said system comprising: a learned access permissions subsystem operative to learn the current access permissions of users in the enterprise to network objects in an enterprise computer environment and to provide an indication of which users are members of which user security groups having access permissions to which network objects; a learned actual access subsystem operative to learn the actual access history of said users in the enterprise to said network objects and to provide an indication of which users have had actual access to which network objects; and a computer security policy administration subsystem, receiving said indications from said learned access permission subsystem and said learned actual access subsystem and being operative to automatically replace pre-selected user-security group-based access permissions with at least partially actual access based access permissions without disrupting user access to said network objects.