Resource management with roles

1 . A method for controlling access to a resource in a distributed computing environment, comprising:

receiving a request for a principal to access the resource;

determining a role that is appropriate for the principal given the resource;

determining whether access to the resource is allowed given the role;

wherein the role is associated with a first resource in a hierarchy of resources; and

wherein the role can supersede a second role associated with a parent of the resource in the hierarchy of resources.

2 . The method of claim 1 wherein:

a role includes one or more expressions.

3 . The method of claim 1 wherein the step of determining whether to allow access to the resource includes:

evaluating the role.

4 . The method of claim 1 wherein:

a resource is part of an enterprise application.

5 . The method of claim 1 wherein:

a resource can inherit a role.

6 . The method of claim 1 wherein:

the role evaluates to true or false for the principal.

7 . The method of claim 1 wherein:

a role includes one or more predicates.

8 . The method of claim 1 , further comprising:

responding to the request.

9 . A machine readable medium having instructions stored thereon to cause a system to:

receive a request for a principal to access a resource;

determine a role that is appropriate for the principal given the resource;

determine whether access to the resource is allowed given the role;

wherein the role is associated with a first resource in a hierarchy of resources; and

wherein the role can supersede a second role associated with a parent of the resource in the hierarchy of resources.

10 . A system for controlling access to a resource in a distributed computing environment, comprising:

a security framework capable of receiving a request for a principal to access the resource;

a first component coupled to the security framework and capable of determining a role that is appropriate for the principal given the resource;

a second component coupled to the security framework and capable of determining whether access to the resource is allowed given the role;

wherein the role is associated with a first resource in a hierarchy of resources; and

wherein the role can supersede a second role associated with a parent of the resource in the hierarchy of resources.

11 . The system of claim 10 wherein:

a role includes one or more expressions.

12 . The system of claim 10 wherein:

determining whether to allow access to the resource includes evaluating the role.

13 . The system of claim 10 wherein:

a resource is part of an enterprise application.

14 . The system of claim 10 wherein:

a resource can inherit a role.

15 . The system of claim 10 wherein:

the role evaluates to true or false for the principal.

16 . The system of claim 10 wherein:

a role includes one or more predicates.

17 . The system of claim 10 wherein:

the security framework is capable of responding to the request.