1. A method comprising: maintaining a plurality of group definitions defining a plurality of groups, wherein the group definitions individually include one or more logic clauses that define membership in a corresponding group, wherein the one or more logic clauses, when evaluated, generate one or more data repository queries corresponding to the group which when executed indicate whether an entity is a member of one or more of the groups, and wherein the groups are either entitled to access the computer resource or not entitled to access the computer resource; analyzing, using a group management engine of a computer system, one or more of the group definitions to determine inefficiently used logic clauses of the one or more logic clauses, wherein analyzing each of the one or more of the group definitions includes parsing the group definitions into a rule tree using a group definition compiler and analyzing one or more tables produced by the rule tree for each of the following conditions: whether a given logic clause of the group definition is over-used, whether a given logic clause of the group definition is under-used, wherein a particular logic clause is under-used if the particular logic clause is not called for a given period of time and the group associated with the particular logic clause can be formed using one or more other logic clauses, and whether a given logic clause of the group definition is inaccurate; in response to determining that one or more logic clauses satisfies a condition of being under-used, over-used, or inaccurate logic clauses, re-factoring the one or more group definitions by eliminating the inefficiently used logic clauses, wherein refactoring eliminates the inefficiency by replacing one or more logic clauses in a rule tree or by writing one or more new logic clauses as a new rule tree; and using the refactored group definitions to assign entitlements to each of the plurality of groups such that members of each group that receives particular entitlements are provided with access to computer resources provisioned based on the assigned entitlements.