Hierarchical permissions model for case management
Case management systems and techniques are disclosed. In various embodiments, a hierarchical permission model is received, comprising for each of at least a subset of case nodes comprising a hierarchical data model associated with a case model a corresponding set of case roles to be afforded permissions with respect to that case node and for each such case role a set of permissions to be associated with that case role with respect to that case node. The hierarchical permission model is used to enforce with respect to one or more case instances associated with the case model the permissions defined in the hierarchical permission model.
1. A computer program product comprising a non-transitory computer readable medium embodying thereon computer executable code comprising instructions for:
accessing a case model comprising a hierarchical data model and a hierarchical permissions model, the hierarchical data model comprising a plurality of case nodes and the hierarchical permission model comprising a hierarchical permission model node corresponding to a corresponding case node from the plurality of case nodes, the hierarchical permission model node specifying a case role and a definition of permissions to be associated with the case role with respect to the corresponding case node; and
enforcing permissions defined by the hierarchical permission model with respect to a case instance instantiated using the case model by allowing, or not allowing, a requested action to be performed, at run time, based on the case role.
2. The computer program product of claim 1 , wherein enforcing the permissions defined by the hierarchical permission model comprises:
based on the hierarchical permission model, associating the case role with a first permission required to perform the requested action with respect to a first case node of the case instance;
receiving a request to perform the requested action with respect to the first case node of the case instance;
determining that a requesting user associated with the request is assigned the case role with respect to the case instance; and
allowing the requested action to be performed based at least in part on the determination that the requesting user is associated with the case role and the determination that the case role is granted the first permission required to perform the requested action with respect to the first case node.
3. The computer program product of claim 2 , wherein the first case node is an instance of the corresponding case node.
4. The computer program product of claim 1 , wherein enforcing the permissions defined by the hierarchical permission model comprises:
based on the hierarchical permission model, associating the case role with a first permission required to perform the requested action with respect to a first case node of the case instance, wherein the first case node is an instance of the corresponding case node;
receiving a request to perform the requested action with respect to a second case node of the case instance, wherein the second case node is descendant of the first case node;
determining that a requesting user associated with the request is assigned the case role with respect to the case instance; and
allowing the requested action to be performed based at least in part on the determination that the requesting user is associated with the case role and the determination that the case role is granted the first permission required to perform the requested action with respect to the first case node.
5. The computer program product of claim 1 , wherein enforcing the permissions defined in the hierarchical permission model with respect to the case instance comprises blocking a request to perform the requested action with respect to a first case node of a first case instance based at least in part on a determination that a requesting user with which the request is associated is not assigned any case role to which a permission required to perform the requested action is granted with respect to the first case node of the first case instance.
6. The computer program product of claim 1 , further comprising instructions for:
instantiating the case instance using the case model, wherein the case instance comprises an instance of the hierarchical data model; and
based on the hierarchical permissions model, setting a first permission for the case role with respect to a first case node of the case instance, wherein the first case node is an instance of the corresponding case node.
7. The computer program product of claim 6 , further comprising instructions for:
based on a determination that the case instance includes a second case node that is a descendent of the first case node, extending the case role the first permission with respect to the second case node.
8. The computer program product of claim 6 , wherein:
the case model associates a state machine with the corresponding case node, the state machine comprising a plurality of case node states;
the definition of permissions to be associated with the case role with respect to the corresponding case node associates the case role with the first permission for a first state of the state machine and associates the case role with a second permission for a second state of the state machine; and
setting the first permission for the case role with respect to the first case node of the case instance comprises dynamically setting the first permission for the case role with respect to the first case node based on a current state of the state machine with respect to the first case node.
9. The computer program product of claim 1 , wherein the definition of permissions to be associated with the case role with respect to the corresponding case node defines a first permission as being conditioned on case node specific data.
10. The computer program product of claim 1 , wherein the definition of permissions to be associated with the case role with respect to the corresponding case node defines a first permission as being conditioned on contextual data.
11. A case management method comprising
accessing, by a processor, a case model comprising a hierarchical data model and a hierarchical permissions model, the hierarchical data model comprising a plurality of case nodes and the hierarchical permission model comprising a hierarchical permission model node corresponding to a corresponding case node from the plurality of case nodes, the hierarchical permission model node specifying a case role and a definition of permissions to be associated with the case role with respect to the corresponding case node; and
enforcing, by the processor, permissions defined by the hierarchical permission model with respect to a case instance instantiated using the case model by allowing, or not allowing, a requested action to be performed, at run time, based on the case role.
12. The method of claim 11 , wherein enforcing the permissions defined by the hierarchical permission model comprises:
based on the hierarchical permission model, associating the case role with a first permission required to perform the requested action with respect to a first case node of the case instance;
receiving a request to perform the requested action with respect to the first case node of the case instance;
determining that a requesting user associated with the request is assigned the case role with respect to the case instance; and
allowing the requested action to be performed based at least in part on the determination that the requesting user is associated with the case role and the determination that the case role is granted the first permission required to perform the requested action with respect to the first case node.
13. The method of claim 12 , wherein the first case node is an instance of the corresponding case node.
14. The method of claim 11 , wherein enforcing the permissions defined by the hierarchical permission model comprises:
based on the hierarchical permission model, associating the case role with a first permission required to perform the requested action with respect to a first case node of the case instance, wherein the first case node is an instance of the corresponding case node;
receiving a request to perform the requested action with respect to a second case node of the case instance, wherein the second case node is descendant of the first case node;
determining that a requesting user associated with the request is assigned the case role with respect to the case instance; and
allowing the requested action to be performed based at least in part on the determination that the requesting user is associated with the case role and the determination that the case role is granted the first permission required to perform the requested action with respect to the first case node.
15. The method of claim 11 , wherein enforcing the permissions defined in the hierarchical permission model with respect to the case instance comprises blocking a request to perform the requested action with respect to a first case node of a first case instance based at least in part on a determination that a requesting user with which the request is associated is not assigned any case role to which a permission required to perform the requested action is granted with respect to the first case node of the first case instance.
16. The method of claim 11 , further comprising the processor performing:
instantiating the case instance using the case model, wherein the case instance comprises an instance of the hierarchical data model; and
based on the hierarchical permissions model, setting a first permission for the case role with respect to a first case node of the case instance, wherein the first case node is an instance of the corresponding case node.
17. The method of claim 16 , further comprising the processor performing:
based on a determination that the case instance includes a second case node that is a descendent of the first case node, extending the case role the first permission with respect to the second case node.
18. The method of claim 16 , wherein:
the case model associates a state machine with the corresponding case node, the state machine comprising a plurality of case node states;
the definition of permissions to be associated with the case role with respect to the corresponding case node associates the case role with the first permission for a first state of the state machine and associates the case role with a second permission for a second state of the state machine; and
setting the first permission for the case role with respect to the first case node of the case instance comprises dynamically setting the first permission for the case role with respect to the first case node based on a current state of the state machine with respect to the first case node.
19. The method of claim 11 , wherein the definition of permissions to be associated with the case role with respect to the corresponding case node defines a first permission as being conditioned on case node specific data.
20. The method of claim 11 , wherein the definition of permissions to be associated with the case role with respect to the corresponding case node defines a first permission as being conditioned on contextual data.