Embedded and distributable policy enforcement

1 . A method for enforcing an authorization policy, comprising:

identifying an authorization policy based on declarative designations of a set of objects, subjects and actions affected by an access request;

distributing an executable entity based on the authorization policy to a plurality of endpoints of a network of users, each endpoint of the plurality of endpoints having a client application, the executable entity further comprising a library, and API calls, the API calls corresponding to code invocations in the client application for transferring control to an API entry point corresponding to the API call;

embedding the executable entity in the client application, the executable entity responsive to access requests from the client application including linking with the client application and identifying library access points invoked from the client application, the library existing local to the endpoint of the client application;

receiving the access request at the client application, the access request indicating a data target covered by the authorization policy;

invoking instructions at the identified library access point of the executable entity, the executable entity codified in executable code, launched and executed in a computing device including memory and a processor upon which the client application executes, disposed between the client and the data target, the instructions invoked directly by the client application with an absence of network exchanges, the client application enforcing the authorization policy based on the invoked instructions; and

granting the access request based on evaluating the access request against the authorization policy, evaluating based on code invocations of instructions in the executable entity and without network exchanges with the server from which the authorization policy emanated.

2 . The method of claim 1 wherein the embedded executable entity is codified in executable code, launched and executed in a computing entity disposed between the client and the data target.

3 . The method of claim 1 further comprising receiving the policy as a set of rules, the rules defining objects, subjects and actions, each rule indicative of an object, a subject permitted to access the object and at least one action the subject may perform on the object.

4 . The method of claim 1 wherein distributing the executable entity further comprises:

storing the library and executable entity in a retrievable location;

authenticating an endpoint to receive the executable entity; and

transmitting, based on the authentication, the library to the endpoint.

5 . The method of claim 1 wherein distributing the executable entity further comprises:

storing the library and executable entity in a retrievable location;

authenticating an endpoint to receive the executable entity; and

transmitting, based on the authentication, the library to the endpoint.

6 . A network device for database access, further comprising:

a query interface to a multidimensional database responsive to access requests from a user according to the method of claim 1 .

7 . The device of claim 6 wherein the executable entity further comprises a library, and API responsive to API calls, the API calls corresponding to code invocations in the client application for transferring control to an API entry point corresponding to the API call.

8 . The method of claim 6 wherein the embedded executable entity is codified in executable code and the memory space disposed in a network between the client and the data target.

9 . The device of any of claim 6 wherein evaluating the access request occurs without network exchanges with the server from which the authorization policy emanated.

10 . The device of claim 6 wherein the received policy includes a set of rules, the rules defining objects, subjects and actions, each rule indicative of an object, a subject permitted to access the object and at least one action the subject may perform on the object.

11 . The device of claim 6 wherein the executable entity further comprises:

the library and executable entity stored in the memory space from an interface with the policy server; and

an authenticated endpoint to receive the executable entity; and

the interface for transmitting, based on the authentication, the library to the endpoint.

12 . The method of claim 1 further comprising invoking instructions in an entry point in the same process and memory space as the client application.

13 . A computer program embodying program code on a non-transitory computer readable storage medium storing instructions that, when executed by a processor, performs steps for implementing a method for enforcing an authorization policy, the method comprising:

identifying an authorization policy based on declarative designations of a set of objects, subjects and actions affected by an access request;

distributing the executable entity to a plurality of endpoints of a network of users, each endpoint of the plurality of endpoints having a client application, the executable entity further comprising a library, and API calls, the API calls corresponding to code invocations in the client application for transferring control to an API entry point corresponding to the API call; and

embedding the executable entity in the client application, the executable entity responsive to access requests from the client application including linking with the client application and identifying library access points invoked from the client application, the library existing local to the endpoint of the client application;

receiving the access request at the client application, the access request indicating a data target covered by the authorization policy;

invoking instructions at the identified library access point of the executable entity, the executable entity codified in executable code, launched and executed in a computing device including memory and a processor upon which the client application executes, disposed between the client and the data target, the instructions invoked directly by the client application with an absence of network exchanges, the client application enforcing the authorization policy based on the invoked instructions; and

granting the access request based on evaluating the access request against the authorization policy, evaluating based on code invocations of instructions in the executable entity and without network exchanges with the server from which the authorization policy emanated.