Attribute-based permissions groups

1 . A computing platform comprising:

at least one network interface;

at least one processor;

at least one non-transitory computer-readable medium; and

program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

receive configuration data defining a permissions group for a construction project, the configuration data indicating a data domain of the construction project and a set of actions that are permitted to be performed on data objects within the data domain that satisfy a condition comprising a particular value for a particular data object attribute;

after receiving the configuration data defining the permissions group, receive a data access request, on behalf of a user account, for a given data object within the data domain;

determine that the user account is a member of the permissions group;

determine that the given data object within the data domain comprises the particular data object attribute having the particular value and thereby satisfies the condition;

based on determining that (i) the user account is a member of the permissions group and (ii) the given data object satisfies the condition, determine that the user account is permitted to perform the set of actions on the given data object;

cause an end-user device associated with the user account to enable performance of the set of actions on the given data object by the user account;

receive, from the end-user device, input indicating a command to execute a given action from the set of actions on the given data object;

based on the input indicating the command, execute the given action, wherein executing the given action causes the particular value for the particular data object attribute to change;

based on the change to the particular value for the particular data object attribute, determine that (i) the given data object within the data domain no longer satisfies the condition and (ii) the user account is no longer permitted to perform the set of actions on the given data object; and

cause the end-user device associated with the user account to disable performance of the set of actions on the given data object by the user account.

2 . The computing platform of claim 1 , wherein the particular value is a first particular value and the condition comprises a set of particular values for the particular data object attribute, the set of particular values including the first particular value and one or more second particular values for the particular data object attribute, and wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to determine that the given data object satisfies the condition comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

determine that the given data object comprises the particular data object attribute having at least one of the two or more particular values in the set of particular values for the particular data object attribute and thereby satisfies the condition.

3 . The computing platform of claim 1 , wherein the condition comprises a respective particular value for each of two or more data object attributes, and wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to determine that the given data object satisfies the condition comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

determine that the given data object comprises the respective particular value for each of the two or more data object attributes and thereby satisfies the condition.

4 . The computing platform of claim 1 , wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to cause the end-user device associated with the user account to enable performance of the set of actions on the given data object comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

cause the end-user device to display a representation of the given data object for receiving one or more user inputs in accordance with the set of actions.

5 . The computing platform of claim 1 , further comprising program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

determine a subset of the data objects within the data domain comprise the particular data object attribute having the particular value and thereby satisfy the condition;

detect one or more changes to one or more values of data object attributes of the data objects within the data domain;

based on the one or more changes, determine that (i) one or more data objects within the subset no longer satisfies the condition and (ii) the user account is no longer permitted to perform the set of actions on the one or more data objects; and

cause the end-user device associated with the user account to disable performance of the set of actions on the one or more data objects by the user account.

6 . The computing platform of claim 1 , wherein the data access request indicates a given data domain of the construction project, the computing platform further comprising program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

determine that the given data domain indicated in the data access request comprises the data domain indicated in the configuration data defining the permissions group and thereby determine that the data access request is to be governed by the permissions group.

7 . The computing platform of claim 1 , wherein the data access request indicates the user account, and wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to determine that the user account is a member of the permissions group comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

identify all permissions groups of which the user account is a member.

8 . The computing platform of claim 1 , wherein the permissions group is a first permissions group and the set of actions is a first set of actions, the computing platform further comprising program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

determine that the user account is also a member of a second permissions group that indicates a second set of actions that are permitted to be performed on data objects within the data domain that satisfy the condition comprising the particular value for the particular data object attribute;

determine that the second set of actions has a broader scope of permission than the first set of actions and thereby determine that the second set of actions is to govern the data access request; and

cause the end-user device associated with the user account to enable performance of the second set of actions on the given data object by the user account.

9 . A non-transitory computer-readable medium, wherein the non-transitory computer-readable medium is provisioned with program instructions that, when executed by at least one processor, cause a computing platform to:

receive configuration data defining a permissions group for a construction project, the configuration data indicating a data domain of the construction project and a set of actions that are permitted to be performed on data objects within the data domain that satisfy a condition comprising a particular value for a particular data object attribute;

after receiving the configuration data defining the permissions group, receive a data access request, on behalf of a user account, for a given data object within the data domain;

determine that the user account is a member of the permissions group;

determine that the given data object within the data domain comprises the particular data object attribute having the particular value and thereby satisfies the condition;

based on determining that (i) the user account is a member of the permissions group and (ii) the given data object satisfies the condition, determine that the user account is permitted to perform the set of actions on the given data object;

cause an end-user device associated with the user account to enable performance of the set of actions on the given data object by the user account;

receive, from the end-user device, input indicating a command to execute a given action from the set of actions on the given data object;

based on the input indicating the command, execute the given action, wherein executing the given action causes the particular value for the particular data object attribute to change;

based on the change to the particular value for the particular data object attribute, determine that (i) the given data object within the data domain no longer satisfies the condition and (ii) the user account is no longer permitted to perform the set of actions on the given data object; and

cause the end-user device associated with the user account to disable performance of the set of actions on the given data object by the user account.

10 . The non-transitory computer-readable medium of claim 9 , wherein the particular value is a first particular value and the condition comprises a set of particular values for the particular data object attribute, the set of particular values including the first particular value and one or more second particular values for the particular data object attribute, and wherein the program instructions that, when executed by at least one processor, cause the computing platform to determine that the given data object satisfies the condition comprise program instructions that, when executed by at least one processor, cause the computing platform to:

determine that the given data object comprises the particular data object attribute having at least one of the two or more particular values in the set of particular values for the particular data object attribute and thereby satisfies the condition.

11 . The non-transitory computer-readable medium of claim 9 , wherein the condition comprises a respective particular value for each of two or more data object attributes, and wherein the program instructions that, when executed by at least one processor, cause the computing platform to determine that the given data object satisfies the condition comprise program instructions that, when executed by at least one processor, cause the computing platform to:

determine that the given data object comprises the respective particular value for each of the two or more data object attributes and thereby satisfies the condition.

12 . The non-transitory computer-readable medium of claim 9 , wherein the program instructions that, when executed by at least one processor, cause the computing platform to cause the end-user device associated with the user account to enable performance of the set of actions on the given data object comprise program instructions that, when executed by at least one processor, cause the computing platform to:

cause the end-user device to display a representation of the given data object for receiving one or more user inputs in accordance with the set of actions.

13 . The non-transitory computer-readable medium of claim 9 , wherein the non-transitory computer-readable medium is also provisioned with program instructions that, when executed by at least one processor, cause the computing platform to:

determine a subset of the data objects within the data domain comprise the particular data object attribute having the particular value and thereby satisfy the condition;

detect one or more changes to one or more values of data object attributes of the data objects within the data domain;

based on the one or more changes, determine that (i) one or more data objects within the subset no longer satisfies the condition and (ii) the user account is no longer permitted to perform the set of actions on the one or more data objects; and

cause the end-user device associated with the user account to disable performance of the set of actions on the one or more data objects by the user account.

14 . The non-transitory computer-readable medium of claim 9 , wherein the data access request indicates a given data domain of the construction project, and wherein the non-transitory computer-readable medium is also provisioned with program instructions that, when executed by at least one processor, cause the computing platform to:

determine that the given data domain indicated in the data access request comprises the data domain indicated in the configuration data defining the permissions group and thereby determine that the data access request is to be governed by the permissions group.

15 . The non-transitory computer-readable medium of claim 9 , wherein the data access request indicates the user account, and wherein the program instructions that, when executed by at least one processor, cause the computing platform to determine that the user account is a member of the permissions group comprise program instructions that, when executed by at least one processor, cause the computing platform to:

identify all permissions groups of which the user account is a member.

16 . The non-transitory computer-readable medium of claim 9 , wherein the permissions group is a first permissions group and the set of actions is a first set of actions, and wherein the non-transitory computer-readable medium is also provisioned with program instructions that, when executed by at least one processor, cause the computing platform to:

determine that the user account is also a member of a second permissions group that indicates a second set of actions that are permitted to be performed on data objects within the data domain that satisfy the condition comprising the particular value for the particular data object attribute;

determine that the second set of actions has a broader scope of permission than the first set of actions and thereby determine that the second set of actions is to govern the data access request; and

cause the end-user device associated with the user account to enable performance of the second set of actions on the given data object by the user account.

17 . A method carried out by a computing platform, the method comprising:

receiving configuration data defining a permissions group for a construction project, the configuration data indicating a data domain of the construction project and a set of actions that are permitted to be performed on data objects within the data domain that satisfy a condition comprising a particular value for a particular data object attribute;

after receiving the configuration data defining the permissions group, receiving a data access request, on behalf of a user account, for a given data object within the data domain;

determining that the user account is a member of the permissions group;

determining that the given data object within the data domain comprises the particular data object attribute having the particular value and thereby satisfies the condition;

based on determining that (i) the user account is a member of the permissions group and (ii) the given data object satisfies the condition, determining that the user account is permitted to perform the set of actions on the given data object;

causing an end-user device associated with the user account to enable performance of the set of actions on the given data object by the user account;

receiving, from the end-user device, input indicating a command to execute a given action from the set of actions on the given data object;

based on the input indicating the command, executing the given action, wherein executing the given action causes the particular value for the particular data object attribute to change;

based on the change to the particular value for the particular data object attribute, determining that (i) the given data object within the data domain no longer satisfies the condition and (ii) the user account is no longer permitted to perform the set of actions on the given data object; and

causing the end-user device associated with the user account to disable performance of the set of actions on the given data object by the user account.

18 . The method of claim 17 , wherein causing the end-user device associated with the user account to enable performance of the set of actions on the given data object comprises:

causing the end-user device to display a representation of the given data object for receiving one or more user inputs in accordance with the set of actions.

19 . The method of claim 17 , further comprising:

determining a subset of the data objects within the data domain comprise the particular data object attribute having the particular value and thereby satisfy the condition;

detecting one or more changes to one or more values of data object attributes of the data objects within the data domain;

based on the one or more changes, determining that (i) one or more data objects within the subset no longer satisfies the condition and (ii) the user account is no longer permitted to perform the set of actions on the one or more data objects; and

causing the end-user device associated with the user account to disable performance of the set of actions on the one or more data objects by the user account.

20 . The method of claim 17 , wherein the permissions group is a first permissions group and the set of actions is a first set of actions, and wherein the method further comprises:

determining that the user account is also a member of a second permissions group that indicates a second set of actions that are permitted to be performed on data objects within the data domain that satisfy the condition comprising the particular value for the particular data object attribute;

determining that the second set of actions has a broader scope of permission than the first set of actions and thereby determine that the second set of actions is to govern the data access request; and

causing the end-user device associated with the user account to enable performance of the second set of actions on the given data object by the user account.