Hierarchical permissions model for case management
Case management systems and techniques are disclosed. In various embodiments, a hierarchical permission model is received, comprising for each of at least a subset of case nodes comprising a hierarchical data model associated with a case model a corresponding set of case roles to be afforded permissions with respect to that case node and for each such case role a set of permissions to be associated with that case role with respect to that case node. The hierarchical permission model is used to enforce with respect to one or more case instances associated with the case model the permissions defined in the hierarchical permission model.
1. A method of managing permissions, comprising:
accessing, by a processor, a hierarchical permission model stored on a storage device, wherein the hierarchical permission model corresponds to a hierarchical data model,
wherein:
the hierarchical data model comprises a plurality of case nodes,
the hierarchical permission model comprises a plurality of hierarchical permission model nodes,
the hierarchical permission model and the hierarchical data model are included in a case model,
each case node in the hierarchical data model corresponds to a corresponding hierarchical permission model node in the hierarchical permission model,
each corresponding hierarchical permission model node defines a corresponding set of case roles to be afforded permissions at the corresponding case node, and for each such case role, the each corresponding hierarchical permission model node defines a set of permissions to be associated with that case role with respect to the corresponding case node, wherein at least a subset of the each corresponding hierarchical permission model node defines at least one of the permissions as being conditioned on corresponding case node specific data that includes a run-time state of a state machine specifically defined for, and associated with, the corresponding case node; and
the processor enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing, a requested action to be performed, at run time, based on a case role to which a requesting user has been assigned.
2. The method of claim 1 , further comprising receiving a case model definition associated with the case model.
3. The method of claim 2 , wherein the case model definition includes a definition of said hierarchical data model.
4. The method of claim 1 , wherein enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances associated with the case model includes:
receiving a request to perform an action with respect to a case node of a case instance;
determining that a requesting user associated with the request is assigned an assigned case role with respect to the case instance;
determining that the assigned case role is granted in the hierarchical permission model, with respect to the case node, a permission required to perform the action with respect to the case node; and
allowing the action to be performed based at least in part on the determination that the requesting user is associated with the assigned case role and the determination that the assigned case role is granted in the hierarchical permission model the permission required to perform the action with respect to the case node.
5. The method of claim 1 , wherein enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances associated with the case model includes blocking a request to perform an action with respect to a case instance based at least in part on a determination that a requesting user with which the request is associated is not assigned a case role to which a permission required to perform the action is granted with respect to a case node affected by the request.
6. The method of claim 1 , wherein the hierarchical permission model defines with respect to a case node with which the case model associates a case node state machine comprising a plurality of case node states one or more permissions conditioned at least in part based on a current state of the case node state machine.
7. The method of claim 6 , wherein enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances associated with the case model includes determining at runtime the current state of the case node state machine and enforcing the permissions as defined in the hierarchical permissions model in light of the determined current state of the case node state machine.
8. The method of claim 6 , wherein the hierarchical permission model indicates with respect to a first state of the case node state machine a first case role that is granted a state transition permission to cause a transition from the first state of the case node state machine to a second state of the case node state machine.
9. The method of claim 1 , wherein the hierarchical permission model indicates a case role having a case role assignment permission to assign a user to a specified case role.
10. The method of claim 1 , wherein a permission granted with respect to a first node in a first hierarchical level of said hierarchical permission model extends to a sub-tree comprising child or other descendant nodes of said first node at levels below said first hierarchical level.
11. The method of claim 1 , wherein said hierarchical permission model associates with a first sub-tree of said hierarchical data model a case role that is defined to have one or more permissions that are contained within said first sub-tree and which do not extend beyond said first sub-tree to other portions of said hierarchical data model.
12. The method of claim 1 , further comprising instantiating a case instance using the case model, the instantiating the case instance including creating an in-memory data structure defined by the case model.
13. A case management system, comprising:
a first storage device configured to store a case model; and
a processor coupled to the first storage device and configured to:
access a hierarchical permission model stored on a second storage device, wherein the hierarchical permission model corresponds to a hierarchical data model,
wherein:
the hierarchical data model comprises a plurality of case nodes,
the hierarchical permission model comprises a plurality of hierarchical permission model nodes,
the hierarchical permission model and the hierarchical data model are included in the case model,
each case node in the hierarchical data model corresponds to a corresponding hierarchical permission model node in the hierarchical permission model,
each corresponding hierarchical permission model node defines a corresponding set of case roles to be afforded permissions at the corresponding case node, and for each such case role, the each corresponding hierarchical permission model node defines a set of permissions to be associated with that case role with respect to the corresponding case node, wherein at least a subset of the each corresponding hierarchical permission model node defines at least one of the permissions as being conditioned on corresponding case node specific data that includes a run-time state of a state machine specifically defined for, and associated with, the corresponding case node; and
enforce the permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing, a requested action to be performed, at run time, based on a case role to which a requesting user has been assigned.
14. The system of claim 13 , wherein the case model comprises a case model definition that includes a definition of said hierarchical data model.
15. The system of claim 13 , wherein enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances associated with the case model includes:
receiving a request to perform an action with respect to a case node of a case instance;
determining that a requesting user associated with the request is assigned an assigned case role with respect to the case instance;
determining that the assigned case role is granted in the hierarchical permission model, with respect to the case node, a permission required to perform the action with respect to the case node; and
allowing the action to be performed based at least in part on the determination that the requesting user is associated with the assigned case role and the determination that the assigned case role is granted in the hierarchical permission model the permission required to perform the action with respect to the case node.
16. The system of claim 13 , wherein enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances associated with the case model includes blocking a request to perform an action with respect to a case instance based at least in part on a determination that a requesting user with which the request is associated is not assigned a case role to which a permission required to perform the action is granted with respect to a case node affected by the request.
17. The system of claim 13 , wherein the hierarchical permission model defines with respect to a case node with which the case model associates a case node state machine comprising a plurality of case node states one or more permissions conditioned at least in part based on a current state of the case node state machine.
18. The system of claim 17 , wherein enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances associated with the case model includes determining at runtime the current state of the case node state machine and enforcing the permissions as defined in the hierarchical permissions model in light of the determined current state of the case node state machine.
19. The system of claim 17 , wherein the hierarchical permission model indicates with respect to a first state of the case node state machine a first case role that is granted a state transition permission to cause a transition from the first state of the case node state machine to a second state of the case node state machine.
20. The system of claim 13 , wherein the processor is configured to instantiate a case instance using the case model, the instantiating the case instance including creating an in-memory data structure defined by the case model.
21. A computer program product to manage a case, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
accessing, by a processor, a hierarchical permission model stored on a storage device, wherein the hierarchical permission model corresponds to a hierarchical data model,
wherein:
the hierarchical data model comprises a plurality of case nodes,
the hierarchical permission model comprises a plurality of hierarchical permission model nodes,
the hierarchical permission model and the hierarchical data model are included in a case model,
each case node in the hierarchical data model corresponds to a corresponding hierarchical permission model node in the hierarchical permission model,
wherein each corresponding hierarchical permission model node defines a corresponding set of case roles to be afforded permissions at the corresponding case node, and for each such case role, the each corresponding hierarchical permission model node defines a set of permissions to be associated with that case role with respect to the corresponding case node, wherein at least a subset of the each corresponding hierarchical permission model node defines at least one of the permissions as being conditioned on corresponding case node specific data that includes a run-time state of a state machine specifically defined for, and associated with, the corresponding case node; and
the processor enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances instantiated using the case model by allowing, or not allowing, a requested action to be performed, at run time, based on a case role to which a requesting user has been assigned.
22. The computer program product of claim 21 , wherein enforcing the permissions defined in the hierarchical permission model with respect to one or more case instances associated with the case model includes:
receiving a request to perform an action with respect to a case node of a case instance;
determining that a requesting user associated with the request is assigned an assigned case role with respect to the case instance;
determining that the assigned case role is granted in the hierarchical permission model, with respect to the case node, a permission required to perform the action with respect to the case node; and
allowing the action to be performed based at least in part on the determination that the requesting user is associated with the assigned case role and the determination that the assigned case role is granted in the hierarchical permission model the permission required to perform the action with respect to the case node.
23. The computer program product of claim 21 , comprising computer instructions for instantiating a case instance using the case model, the instantiating the case instance including creating an in-memory data structure defined by the case model.