Look into landdesk or programs like it. They can inventory allsoftware and applied or remove software from a machine depending on group membership. ei. a trader will use bloomberg as a backoffice will not but will use efax. the backoffice person becomes a trader and it is put into the traders group and taken out of backoffice group. Bloomberg will be automatically install and efax will be remove. AS per access to resources you can create scripts and if you take the person out of a group it can execute the script to remove access that that group has. But there will always be a manual intervention. One thing to keep in mind is that you will need to work hard to get to that level of automatization (may be to hard and too much $$$). Hope this helps.