A method for determining access rights to IT resources

An operational firewall is disclosed that controls access to resources with an IT system. The IT system receives a plurality of commands from a requesting entity and each command requests access to a resource in order to perform a function as defined by a procedure. The operational firewall, for each received command, determines a relationship between, the received command, an identified characteristic of the received command and the requested resource. In response to the relationship being determined, a status is assigned to the command and a determination is made as to whether the requesting entity has an appropriate level of authority in order to perform the command on the resource. If the requesting entity does not have an appropriate level of authority, access is denied to the requested resource and an alternative command to be performed is suggested.