Controlling access to a software application

1. A system for controlling access to a software application, the system comprising:

a policy machine template generator for generating a policy machine template based on roles and permissions for operators; and

a policy machine generator, coupled to the policy machine template generator, for generating a policy machine based on operators and objects,

wherein the policy machine:

is an access control framework permitting directed acyclic graph relationships between objects; and

operates to control access to the software application.

2. The system of claim 1 , wherein the software application runs on a distributed network.

3. The system of claim 1 , wherein the roles comprise a clinical trial role.

4. The system of claim 1 , wherein the roles comprise an information technology system role.

5. The system of claim 1 , wherein the objects comprise a clinical study.

6. The system of claim 1 , wherein the objects comprise a clinical study site.

7. The system of claim 1 , wherein access to a plurality of software applications is controlled.

8. The system of claim 1 , wherein the policy machine is configured to produce capabilities for the operators of the software application.

9. The system of claim 8 , wherein the capabilities comprise the users being able to perform operations on the objects.

10. The system of claim 1 , wherein the operators are users.

11. The system of claim 1 , wherein the operators are roles.

12. The system of claim 1 , wherein the operators are applications.

13. A method for controlling access to a software application, comprising:

assigning at least one role and at least one permission to said role;

generating a policy machine template based on the role and the permission;

assigning at least one user to the role;

generating a policy machine based on the user and objects associated with the user, wherein the policy machine is an access control framework permitting directed acyclic graph relationships between objects; and

maintaining at least one logical link between the policy machine template and the policy machine,

wherein the policy machine operates to control access to the software application.

14. The method of claim 13 , further comprising updating the policy machine template.

15. The method of claim 14 , further comprising updating the at least one role and at least one permission.

16. The method of claim 13 , further comprising updating the policy machine.

17. The method of claim 16 , further comprising updating the user and objects associated with the user.

18. An apparatus for controlling access to a software application, comprising:

a policy machine template based on roles and permissions for operators; and

a policy machine, coupled to the policy machine template and based on users operators and objects, wherein the policy machine is an access control framework permitting directed acyclic graph relationships between objects and the policy machine operates to control access to the software application.

19. The apparatus of claim 18 , wherein the software application runs on a distributed network.

20. The apparatus of claim 18 , wherein the roles comprise a clinical trial role.

21. The apparatus of claim 18 , wherein the roles comprise an information technology system role.

22. The apparatus of claim 18 , wherein the objects comprise a clinical study.

23. The apparatus of claim 18 , wherein the objects comprise a clinical study site.

24. The apparatus of claim 18 , wherein the policy machine is an acyclic graph.