Enforcement of authorization rules across data environments
The technology disclosed herein enables enforcement of high-level rules defined by a user across multiple data environments. In a particular embodiment, a method includes receiving a high-level rule from a user for enforcement across a plurality of data environments and interpreting the high-level rule into a computer-readable rule. The method further includes translating the computer-readable rule into an instruction compatible with a data environment of the plurality of data environments. The method also includes providing the instruction to the data environment, wherein the data environment implements the high-level rule within the data environment based on the instruction.
1 . A method comprising:
receiving a high-level rule in natural language from a user for enforcement across a plurality of data environments, wherein the high-level rule identifies a user;
interpreting the high-level rule into a computer-readable rule using a natural language processing algorithm to determine an intent behind words in the natural language, wherein interpreting the high-level rule includes validating that the high-level rule includes sufficient information such that a policy intended by the high-level rule can be implemented within the plurality of data environments;
querying a plurality of identity environments for identities of the user corresponding to different ones of the plurality of data environments, wherein at least one of the identities is different from another of the identities;
selecting an identity of the identities that corresponds to a data environment of the plurality of data environments;
translating the computer-readable rule into an instruction compatible with the data environment, wherein the instruction uses the identity to indicate the user; and
providing the instruction to the data environment, wherein the data environment implements the high-level rule within the data environment based on the instruction.
2 . The method of claim 1 , comprising:
translating the computer-readable rule into another instruction compatible with another data environment of the plurality of data environments, wherein the instruction uses a second identity corresponding to the other data environment to indicate the user; and
providing the other instruction to the other data environment, wherein the other data environment implements the high-level rule within the other data environment based on the instruction.
3 . The method of claim 2 , comprising:
determining the data environment and the other data environment both include data sources that are subject to the high-level rule.
4 . The method of claim 2 , wherein the instruction comprises an authorization statement compatible with the data environment and the other instruction comprises another authorization statement compatible with the other data environment, and wherein the authorization statement is different than the other authorization statement.
5 . The method of claim 1 , wherein the instruction comprises a Create, Read, Update, and Delete (CRUD) statement.
6 . The method of claim 1 , wherein the identity indicates the user differently than the user is indicated in the high-level rule.
7 . The method of claim 1 , wherein validating the high-level rule comprises:
when the policy includes at least one deficiency such that the policy cannot be implemented in the plurality of data environments, notifying the user that the high-level rule is invalid; and
after notifying the user, receiving updates to the high-level rule that remedy the deficiency.
8 . The method of claim 1 , wherein the interpreting comprises:
creating a JavaScript Object Notation (JSON) document that encodes the high-level rule.
9 . The method of claim 1 , comprising:
in response to identifying a change in the data environment, generating a new instruction based on the computer-readable rule that accounts for the change; and
providing the new instruction to the data environment, wherein the data environment implements the high-level rule within the data environment based on the new instruction.
10 . An apparatus comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the apparatus to:
receive a high-level rule in natural language from a user for enforcement across a plurality of data environments, wherein the high-level rule identifies a user;
interpret the high-level rule into a computer-readable rule using a natural language processing algorithm to determine an intent behind words in the natural language, wherein interpreting the high-level rule includes validating that the high-level rule includes sufficient information such that a policy intended by the high-level rule can be implemented within the plurality of data environments;
query a plurality of identity environments for identities of the user corresponding to different ones of the plurality of data environments, wherein at least one of the identities is different from another of the identities;
select an identity of the identities that corresponds to a data environment of the plurality of data environments;
translate the computer-readable rule into an instruction compatible with the data environment, wherein the instruction uses the identity to indicate the user; and
provide the instruction to the data environment, wherein the data environment implements the high-level rule within the data environment based on the instruction.
11 . The apparatus of claim 10 , wherein the program instructions direct the apparatus to:
translate the computer-readable rule into another instruction compatible with another data environment of the plurality of data environments; and
provide the other instruction to the other data environment, wherein the other data environment implements the high-level rule within the other data environment based on the other instruction.
12 . The apparatus of claim 11 , wherein the program instructions direct the apparatus to:
determine the data environment and the other data environment both include data sources that are subject to the high-level rule.
13 . The apparatus of claim 11 , wherein the instruction comprises an authorization statement compatible with the data environment and the other instruction comprises another authorization statement compatible with the other data environment, and wherein the authorization statement is different than the other authorization statement.
14 . The apparatus of claim 10 , wherein the instruction comprises a Create, Read, Update, and Delete (CRUD) statement.
15 . The apparatus of claim 10 , wherein the identity indicates the user differently than the user is indicated in the high-level rule.
16 . The apparatus of claim 10 , wherein to validate the high-level rule, the program instructions direct the apparatus to:
when the policy includes at least one deficiency such that the policy cannot be implemented in the plurality of data environments, notify the user that the high-level rule is invalid; and
after the user is notified, receive updates to the high-level rule that remedy the deficiency.
17 . The apparatus of claim 10 , wherein to interpret the high-level rule, the program instructions direct the apparatus to:
create a JavaScript Object Notation (JSON) document that encodes the high-level rule.
18 . The apparatus of claim 10 , wherein the program instructions direct the apparatus to:
in response to identifying a change in the data environment, generate a new instruction based on the computer-readable rule that accounts for the change; and
provide the new instruction to the data environment, wherein the data environment implements the high-level rule within the data environment based on the new instruction.
19 . One or more computer readable storage media having program instructions stored thereon that, when read and executed by a processing system, direct the processing system to:
receive a high-level rule in natural language from a user for enforcement across a plurality of data environments, wherein the high-level rule identifies a user;
interpret the high-level rule into a computer-readable rule using a natural language processing algorithm to determine an intent behind words in the natural language, wherein interpreting the high-level rule includes validating that the high-level rule includes sufficient information such that a policy intended by the high-level rule can be implemented within the plurality of data environments;
query a plurality of identity environments for identities of the user corresponding to different ones of the plurality of data environments, wherein at least one of the identities is different from another of the identities;
select an identity of the identities that corresponds to a data environment of the plurality of data environments;
translate the computer-readable rule into an instruction compatible with the data environment, wherein the instruction uses the identity to indicate the user; and
provide the instruction to the data environment, wherein the data environment implements the high-level rule within the data environment based on the instruction.
20 . The one or more computer readable storage media of claim 19 , wherein the program instructions direct the processing system to:
translate the computer-readable rule into another instruction compatible with another data environment of the plurality of data environments; and
provide the other instruction to the other data environment, wherein the other data environment implements the high-level rule within the other data environment based on the other instruction.