Just-in-time data object permission restriction

1. A method comprising:

receiving, using a computer system, an instruction to define or modify a permission constraint corresponding to one or more files, wherein the one or more files includes a particular file;

storing, in a data store, a permission-instruction data set representing the permission constraint;

subsequent to storing the permission-instruction data set, intercepting a user request to access the particular file;

querying the data store to determine whether any pending permission-instruction data set corresponds to the particular file;

determining, in response to the querying, that the permission-instruction data set corresponds to the particular file;

modifying or adding the permission constraint of the particular file based on the permission-instruction data set;

determining, based on the modified or added permission constraint, whether and or an extent to which the user request is authorized; and

outputting a response to the user request based on the determination as to whether and or an extent to which the user request is authorized.

2. The method of claim 1 , wherein an operating system performs the intercepting the user request, the querying the data store, and the determining that the permission-instruction data set corresponds to the particular file.

3. The method of claim 1 , wherein modifying or adding the permission constraint includes adding a permission constraint that disallows modification to content of the particular file and that disallows deleting the particular file, and wherein the response to the user request includes a read-only version of the particular file.

4. The method of claim 1 , wherein the permission-instruction data set identifies a particular period of time during which the permission constraint is to be applied, and wherein the method further comprises:

upon determining that the permission-instruction data set corresponds to the particular file, determining that a current time is within the particular period of time.

5. The method of claim 1 , wherein the user request was received at the computer system from a user device, wherein the computer system at least partly controls a set of files that are remote from the user device, and wherein the set of files includes the particular file.

6. The method of claim 1 , wherein the modifying or adding the permission constraint occurs at least two weeks after the storing the permission-instruction data set.

7. The method of claim 1 , wherein the instruction identifies one or more file attributes and indicates that permission constraint is to apply to any file, within a set of files, that has the one or more file attributes, and wherein determining that the permission-instruction data set corresponds to the particular file includes determining that the particular file has the one or more file attributes.

8. A system comprising:

one or more data processors; and

a non-transitory computer readable storage medium containing instructions which, when executed on the one or more data processors, cause the one or more data processors to perform a set of actions including:

receiving an instruction to define or modify a permission constraint corresponding to one or more files, wherein the one or more files includes a particular file;

storing, in a data store, a permission-instruction data set representing the permission constraint;

subsequent to storing the permission-instruction data set, intercepting a user request to access the particular file;

querying the data store to determine whether any pending permission-instruction data set corresponds to the particular file;

determining, in response to the querying, that the permission-instruction data set corresponds to the particular file;

modifying or adding a permission constraint of the particular file based on the permission-instruction data set;

determining, based on the modified or added permission constraint, whether and or an extent to which the user request is authorized; and

outputting a response to the user request based on the determination as to whether and or an extent to which the user request is authorized.

9. The system of claim 8 , wherein an operating system performs the intercepting the user request, the querying the data store, and the determining that the permission-instruction data set corresponds to the particular file.

10. The system of claim 8 , wherein modifying or adding the permission constraint includes adding a permission constraint that disallows modification to content of the particular file and that disallows deleting the particular file, and wherein the response to the user request includes a read-only version of the particular file.

11. The system of claim 8 , wherein the permission-instruction data set identifies a particular period of time during which the permission constraint is to be applied, and wherein the set of actions further comprises:

upon determining that the permission-instruction data set corresponds to the particular file, determining that a current time is within the particular period of time.

12. The system of claim 8 , wherein the user request was received at the system from a user device, wherein the system at least partly controls a set of files that are remote from the user device, and wherein the set of files includes the particular file.

13. The system of claim 8 , wherein the modifying or adding the permission constraint occurs at least two weeks after the storing the permission-instruction data set.

14. The system of claim 8 , wherein the instruction identifies one or more file attributes and indicates that permission constraint is to apply to any file, within a set of files, that has the one or more file attributes, and wherein determining that the permission-instruction data set corresponds to the particular file includes determining that the particular file has the one or more file attributes.

15. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to perform a set of actions including:

receiving, using a computer system, an instruction to define or modify a permission constraint corresponding to one or more files, wherein the one or more files includes a particular file;

storing, in a data store, a permission-instruction data set representing the permission constraint;

subsequent to storing the permission-instruction data set, intercepting a user request to access the particular file;

querying the data store to determine whether any pending permission-instruction data set corresponds to the particular file;

determining, in response to the querying, that the permission-instruction data set corresponds to the particular file;

modifying or adding a permission constraint of the particular file based on the permission-instruction data set;

determining, based on the modified or added permission constraint, whether and or an extent to which the user request is authorized; and

outputting a response to the user request based on the determination as to whether and or an extent to which the user request is authorized.

16. The computer-program product of claim 15 , wherein an operating system performs the intercepting the user request, the querying the data store, and the determining that the permission-instruction data set corresponds to the particular file.

17. The computer-program product of claim 15 , wherein modifying or adding the permission constraint includes adding a permission constraint that disallows modification to content of the particular file and that disallows deleting the particular file, and wherein the response to the user request includes a read-only version of the particular file.

18. The computer-program product of claim 15 , wherein the permission-instruction data set identifies a particular period of time during which the permission constraint is to be applied, and wherein the set of actions further comprises:

upon determining that the permission-instruction data set corresponds to the particular file, determining that a current time is within the particular period of time.

19. The computer-program product of claim 15 , wherein the user request was received at the computer system from a user device, wherein the computer system at least partly controls a set of files that are remote from the user device, and wherein the set of files includes the particular file.

20. The computer-program product of claim 15 , wherein the modifying or adding the permission constraint occurs at least two weeks after the storing the permission-instruction data.