Constructing and enforcing access control policies

1 . A method comprising:

providing a local instance of a user interface to a client device, the user interface comprising an arrangement of interface elements, wherein one or more of the interface elements are configured to display data from cells of a database;

receiving, from the client device, a query to access a set of one or more cells of the database;

accessing a policy object for the user interface specifying which cells of the database can be accessed by the user interface, wherein the policy object is based on an element permission for an interface element of the user interface, the element permission specifying data of the interface element accessible to users of the user interface; and

processing the query according to the policy object, wherein processing the query comprises providing data from the database that the user interface provides access to without providing other data from the database that should not be accessible according to the policy object, wherein the policy object includes a dependency graph that specifies a hierarchy of permissions for cells of the database.

2 . The method of claim 1 , wherein the query is a read query, a write query, or a schema change query.

3 . The method of claim 1 , wherein the dependency graph includes a table policy, which includes a column policy, which includes a row policy.

4 . The method of claim 1 , wherein processing the query according to the policy object comprises: traversing the dependency graph of the policy object to determine whether any paths of the dependency graph grant access to the set of one or more cells of the database.

5 . The method of claim 1 , wherein processing the query according to the policy object comprises: determining which one or more cells of the set of one or more cells the policy object for the user interface provides access to.

6 . The method of claim 5 , wherein processing the query according to the policy object further comprises: denying access to a first cell of the set of one or more cells of the database.

7 . The method of claim 6 , wherein processing the query according to the policy object further comprises: granting access to a second cell of the set of one or more cells of the database.

8 . The method of claim 1 , wherein processing the query is part of a process comprising:

receiving a plurality of queries to access cells of the database, wherein the plurality of queries includes the query; and

processing the plurality of queries sequentially according to the order in which queries of the plurality of queries were received.

9 . A method comprising:

providing a local instance of a user interface to a client device, the user interface comprising an arrangement of interface elements, wherein one or more of the interface elements are configured to display data from cells of a database;

receiving, from the client device, a query to access a set of one or more cells of the database;

accessing a policy object for the user interface specifying which cells of the database can be accessed by the user interface, wherein the policy object is based on an element permission for an interface element of the user interface, the element permission specifying data of the interface element accessible to users of the user interface; and

processing the query according to the policy object, wherein processing the query comprises providing data from the database that the user interface provides access to without providing other data from the database that should not be accessible according to the policy object,

wherein processing the query is part of a process comprising:

receiving a plurality of queries to access cells of the database, wherein the plurality of queries includes the query; and

processing the plurality of queries sequentially according to the order in which queries of the plurality of queries were received, wherein responsive to determining a first query of the plurality of queries affects a dependency of the policy object, delaying processing subsequent queries until the policy object is updated or a new policy object is generated.

10 . The method of claim 9 , wherein the policy object includes a dependency graph that specifies a hierarchy of permissions for cells of the database.

11 . A non-transitory computer-readable storage medium storing instructions that, when executed by a computing system, cause the computing system to perform comprising:

providing a local instance of a user interface to a client device, the user interface comprising an arrangement of interface elements, wherein one or more of the interface elements are configured to display data from cells of a database;

receiving, from the client device, a query to access a set of one or more cells of the database;

accessing a policy object for the user interface specifying which cells of the database can be accessed by the user interface, wherein the policy object is based on an element permission for an interface element of the user interface, the element permission specifying data of the interface element accessible to users of the user interface; and

processing the query according to the policy object, wherein processing the query comprises providing data from the database that the user interface provides access to without providing other data from the database that should not be accessible according to the policy object, wherein the policy object includes a dependency graph that specifies a hierarchy of permissions for cells of the database.

12 . The non-transitory computer-readable storage medium of claim 11 , wherein the query is a read query, a write query, or a schema change query.

13 . The non-transitory computer-readable storage medium of claim 11 , wherein the dependency graph includes a table policy, which includes a column policy, which includes a row policy.

14 . The non-transitory computer-readable storage medium of claim 11 , wherein processing the query according to the policy object comprises: traversing the dependency graph of the policy object to determine whether any paths of the dependency graph grant access to the set of one or more cells of the database.

15 . The non-transitory computer-readable storage medium of claim 11 , wherein processing the query according to the policy object comprises: determining which one or more cells of the set of one or more cells the policy object for the user interface provides access to.

16 . The non-transitory computer-readable storage medium of claim 15 , wherein processing the query according to the policy object further comprises: denying access to a first cell of the set of one or more cells of the database.

17 . The non-transitory computer-readable storage medium of claim 16 , wherein processing the query according to the policy object further comprises: granting access to a second cell of the set of one or more cells of the database.

18 . The non-transitory computer-readable storage medium of claim 11 , wherein processing the query is part of a process comprising:

receiving a plurality of queries to access cells of the database, wherein the plurality of queries includes the query; and

processing the plurality of queries sequentially according to the order in which queries of the plurality of queries were received.

19 . The non-transitory computer-readable storage medium of claim 18 , wherein responsive to determining a first query of the plurality of queries affects a dependency of the policy object, delaying processing subsequent queries until the policy object is updated or a new policy object is generated.

20 . A non-transitory computer-readable storage medium storing instructions that, when executed by a computing system, causes the computing system to perform operations comprising:

providing a local instance of a user interface to a client device, the user interface comprising an arrangement of interface elements, wherein one or more of the interface elements are configured to display data from cells of a database;

receiving, from the client device, a query to access a set of one or more cells of the database;

accessing a policy object for the user interface specifying which cells of the database can be accessed by the user interface, wherein the policy object is based on an element permission for an interface element of the user interface, the element permission specifying data of the interface element accessible to users of the user interface; and

processing the query according to the policy object, wherein processing the query comprises providing data from the database that the user interface provides access to without providing other data from the database that should not be accessible according to the policy object,

wherein processing the query is part of a process comprising:

receiving a plurality of queries to access cells of the database, wherein the plurality of queries includes the query; and

processing the plurality of queries sequentially according to the order in which queries of the plurality of queries were received,

wherein responsive to determining a first query of the plurality of queries affects a dependency of the policy object, delaying processing subsequent queries until the policy object is updated or a new policy object is generated.

21 . The non-transitory computer-readable storage medium of claim 20 , wherein the policy object includes a dependency graph that specifies a hierarchy of permissions for cells of the database.