User interface model driven data access control

1. A method comprising:

maintaining a data model of data entities from a backend data device employed by a user interface, the data entities including a first leading data entity and at least one child data entity associated with the first leading data entity, the data model including a hierarchical relationship between the first leading data entity and the at least one child data entity;

receiving a request for a data entry;

determining whether the requested data entry is the first leading data entity or a child data entity;

authorizing, with an authorization device, retrieval of the first leading data entity when the requested data entry is determined as the first leading data entity;

instructing the authorization device that subsequent retrieval of the data entities associated with the first leading data entity are to be authorized based on the authorization of the first leading data entity, wherein the authorization device enters a privileged operation mode; and

retrieving the at least one child data entity associated with the first leading data entity without further authorization while the authorization device is in the privileged operation mode.

2. The method of claim 1 , wherein maintaining a data model includes dynamically creating the data model as a user accesses different portions of the user interface.

3. The method of claim 1 , further comprising:

receiving a request from the user interface to access a second leading data entity;

deactivating the privileged operation mode by instructing the authorization device to request authorization for each subsequent data entity access; and

accessing the second leading data entity by providing an authorization credential for the second leading data entity.

4. The method of claim 1 , further comprising:

deriving, based at least on a user's access rights with respect to the first leading data entity, the user's access rights with respect to the child data entities associated with the first leading data entity.

5. The method of claim 4 , further comprising:

altering the user interface based upon the user's access rights with respect to child data entities.

6. The method of claim 1 , wherein the privileged operation mode makes the user interface backend a trusted consumer of the authorization device.

7. The method of claim 1 , wherein maintaining a data model includes deriving the relationship between two data entities based upon, at least in part, a navigation path through the user interface a user may take to access the data entities.

8. The method of claim 7 , wherein the navigation path includes a plurality of user interface elements of the user interface.

9. An apparatus comprising:

a processor configured to maintain a data model of data entities from a backend data device employed by a user interface, the data entities including a leading data entity and at least one child data entity associated with the leading data entity, the data model including a hierarchical relationship between the first leading data entity and the at least one child data entity; and

a network interface configured to:

receive a request for a data entry;

determine whether the requested data entry is the first leading data entity or a child data entity;

authorize, with an authorization device, retrieval of the first leading data entity when the requested data entry is determined as the first leading data entity,

instruct the authorization device that subsequent retrieval of the data entities associated with the leading data entity are to be authorized based on the authorization of the first leading data entity, wherein the authorization device enters a privileged operation mode, and

retrieve the at least one child data entity associated with the first leading data entity without further authorization while the authorization device is in the privileged operation mode.

10. The apparatus of claim 9 , wherein the processor is configured to dynamically create the data model as a user accesses different portions of the user interface.

11. The apparatus of claim 9 , wherein the network interface is configured to:

receive a request from the user interface to access a second leading data entity;

deactivate the privileged operation mode by instructing the authorization device to request authorization for each subsequent data entity access; and

access the second leading data entity by providing an authorization credential for the second leading data entity.

12. The apparatus of claim 9 , wherein the privileged operation mode makes the apparatus a trusted consumer of the authorization device.

13. A method comprising:

receiving a request for a data entry;

determining whether the requested data entry is a first leading data entity or a child data entity;

authorizing, by an authorization device, a user interface backend's right to access and retrieve the leading data entity when the requested data entry is determined as the first leading data entity;

retrieving and providing the leading data entity to the user interface backend;

receiving an instruction, from the user interface backend, to authorize subsequent retrieval of data entities associated with the leading data entity by the user interface runtime based on the authorization of the leading data entity access, wherein the authorization devices enters a privileged operation mode; and

fulfilling requests for retrieval of the subsequent data entities, from the user interface backend, using the authorization of the leading data access such that further authorization is not needed while the authorization device is in the privileged operation mode.

14. The method of claim 13 , wherein the user interface backend maintains a data model that includes a hierarchical relationship between the leading data entity and the data entities including the child data entity.

15. The method of claim 14 , wherein the data model is dynamically created as a user accesses different portions of a user interface associated with the user interface backend.

16. The method of claim 13 , wherein the requests for retrieval of the subsequent data entities include requests for child data entities associated with the leading data entity.

17. The method of claim 13 , further comprising:

receiving a second instruction, from the user interface backend, to cease authorizing data entity retrievals by the user interface backend based upon the authorization of the leading data entity access; and

requiring separate authorization for each subsequent data entity access from the user interface backend.