Method for role and resource policy management
A method for adaptively managing entitlements, comprising the steps of providing for the association of a role with a first resource; and providing for the association of a policy with a second resource, wherein the policy is based at least partially on the role; and providing for hierarchically relating the role and the policy; and wherein the role is hierarchically equal or superior to the policy.
1. A method for managing entitlements in an enterprise application, comprising the steps of:
associating a role with a first enterprise application resource;
associating a policy with a second enterprise application resource, wherein the policy is based at least partially on the role;
mapping the role to a principal in order to determine whether or not the principal can access the second application resource;
wherein the first application resource is hierarchically related to the second application resource;
wherein the second application resource can inherit one or more roles associated with the first application resource;
wherein the role is hierarchically equal or superior to the policy;
the role can supersede a second role associated with a parent of the first application resource; and
wherein the policy can supersede a second policy associated with a parent of the second application resource.
2. The method of claim 1 wherein:
the step of associating the policy with the second application resource is initiated by an authenticated user, group or process.
3. The method of claim 1 wherein the step of mapping the role further comprises:
evaluating the role to true or false for a principal in a context.
4. The method of claim 1 wherein:
the role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.
5. The method of claim 4 wherein:
the predicate is one of a user, group, time and segment.
6. The method of claim 4 wherein:
the predicate can be evaluated against the principal and a context.
7. The method of claim 4 wherein:
the predicate is specified in natural language.
8. The method of claim 1 wherein:
the policy is an association between the second resource and a set of roles.
9. A method for managing entitlements, comprising the steps of:
associating a first role with a first resource in a hierarchy of resources;
associating a first policy with a second resource in the hierarchy of resources, wherein the first policy is based at least partially on the first role;
wherein the second resource in the hierarchy of resources is capable of inheriting at least one role associated with the first resource in the hierarchy of resources;
wherein the first role can supersede a second role associated with a parent of the first resource; and
wherein the first policy can supersede a second policy associated with a parent of the second resource.
10. The method of claim 9 wherein:
the step of associating the first policy with the second resource is initiated by an authenticated user, group or process.
11. The method of claim 9 including the step of:
mapping the first role to a principal in order to determine whether or not the principal can access the second resource.
12. The method of claim 9 including the step of:
evaluating the first role to true or false for a principal in a context.
13. The method of claim 9 wherein:
the first role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.
14. The method of claim 13 wherein:
the predicate is one of a user, group, time and segment.
15. The method of claim 13 wherein:
the predicate can be evaluated against a principal and a context.
16. The method of claim 15 wherein:
the predicate is specified in natural language.
17. The method of claim 9 wherein:
the first policy is an association between the second resource and a set of roles.
18. The method of claim 9 wherein:
the first resource and the second resource are part of an enterprise application.
19. A method for managing entitlements, comprising the steps of:
associating a role with a first resource in a hierarchy of resources;
associating a policy with a second resource in the hierarchy of resources, wherein the policy is based at least partially on the role; and
wherein the second resource in the hierarchy of resources is capable of inheriting at least one role associated with the first resource in the hierarchy of resources;
wherein the second resource in the hierarchy of resources is capable of inheriting at least one policy associated with the first resource in the hierarchy of resources;
wherein the role can block a less local role; and
wherein the policy can block a less local policy.
20. The method of claim 19 wherein:
the step of associating the policy with the second resource is initiated by an authenticated user, group or process.
21. The method of claim 19 including the step of:
mapping the role to a principal in order to specify whether or not the principal can access the second resource.
22. The method of claim 19 including the step of:
evaluating the role to true or false for a principal in a context.
23. The method of claim 19 wherein:
the role is a Boolean expression that can include at least one of (1) another Boolean expression and (2) a predicate.
24. The method of claim 23 wherein:
the predicate is one of a user, group, time and segment.
25. The method of claim 23 wherein:
the predicate can be evaluated against a principal and a context.
26. The method of claim 23 wherein:
the predicate is specified in natural language.
27. The method of claim 19 wherein:
the policy is an association between the second resource and a set of roles.
28. The method of claim 19 wherein:
the first resource and the second resource are part of an enterprise application.