Granted Patent B2

US 12,299,106 · App. 18/109,134 · Granted May 13, 2025

Inventors: Hannah Korus (Palo Alto, CA); Brian Schimpf (Washington, DC); Lam Tran (Palo Alto, CA); Mark Elliot (London, GB); Robert Kruszewski (London, GB)

Assignee: Palantir Technologies Inc.

G06F21/335G06F9/4881G06F21/604G06F21/62

Abstract

Claims (75)

1. A computer-implemented method, implemented by a computing system, the method comprising:

receiving, from a client device associated with a user or from a service, a job associated with a project, wherein the project is associated with one or more data sources;

determining first permissions corresponding to the client device or the service and second permissions corresponding to a second client device or a second service, wherein:

each of the first permissions comprises an operation on a data source;

generating a token associated with the job, the token encoding the first permissions or the second permissions;

receiving a request from the client device or the service for the token;

determining whether the client device or the service is authorized to execute the job based on the first permissions;

in response to determining that the client device or the service is authorized to execute the job, granting the token to the client device or the service to enable the client device or the service to execute the job; and

in response to executing the job, selectively transmitting a result of the execution of the job to a different client device or a different service based on whether the different client device or the different service is authorized to access the result, based on the second permissions.

2. The computer-implemented method of claim 1 , wherein the job comprises one or more data transformations.

3. The computer-implemented method of claim 1 , wherein the one or more data sources associated with the project comprise:

one or more data sources internal to the project; or

one or more data sources external to the project, wherein the project comprises a reference to each of the one or more data sources external to the project.

4. The computer-implemented method of claim 1 , wherein the one or more required permissions comprise:

reading data from a data source external to the project; or writing to a data source external to the project.

5. The computer-implemented method of claim 1 , further comprising:

communicating, to the client device or the service, a response approving the request.

6. The computer-implemented method of claim 1 , further comprising:

obtaining a result associated with execution of the one or more data transformations;

verifying that the service possesses one or more access permissions associated with accessing the result; and

providing the result to the service.

7. The computer-implemented method of claim 1 , wherein the service comprises a first service, the request comprises a first request, and the computer-implemented method further comprising:

receiving, from a second service, a second request to execute one or more data transformations, wherein the second request comprises the token associated with the job;

determining that at least one of the one or more data transformations require a permission exceeding the permissions encoded in the token; and

communicating, to the second service, a response denying the request.

8. A system comprising:

at least one processor; and

a memory storing instructions that, when executed by the at least one processor, cause the system to perform operations comprising:

receiving, from a client device associated with a user or from a service, a job associated with a project, wherein the project is associated with one or more data sources;

determining first permissions corresponding to the client device or the service and second permissions corresponding to a second client device or a second service, wherein:

each of the first permissions comprises an operation on a data source;

generating a token associated with the job, the token encoding the first permissions or the second permissions;

receiving a request from the client device or the service for the token;

determining whether the client device or the service is authorized to execute the job based on the first permissions;

in response to determining that the client device or the service is authorized to execute the job, granting the token to the client device or the service to enable the client device or the service to execute the job; and

in response to executing the job, selectively transmitting a result of the execution of the job to a different client device or a different service based on whether the different client device or the different service is authorized to access the result, based on the second permissions.

9. The system of claim 8 , wherein the job comprises one or more data transformations.

10. The system of claim 8 , wherein the one or more data sources associated with the project comprise:

one or more data sources internal to the project; or

one or more data sources external to the project, wherein the project comprises a reference to each of the one or more data sources external to the project.

11. The system of claim 8 , wherein the one or more required permissions comprise:

reading data from a data source external to the project; or writing to a data source external to the project.

12. The system of claim 8 , wherein the instructions that, when executed by the at least one processor, cause the system to perform operations comprising:

communicating, to the client device or the service, a response approving the request.

13. The system of claim 8 , wherein the instructions that, when executed by the at least one processor, cause the system to perform operations comprising:

obtaining a result associated with execution of the one or more data transformations;

verifying that the service possesses one or more access permissions associated with accessing the result; and

providing the result to the service.

14. The system of claim 8 , wherein the service comprises a first service, the request comprises a first request, and the instructions that, when executed by the at least one processor, cause the system to perform operations comprising:

receiving, from a second service, a second request to execute one or more data transformations, wherein the second request comprises the token associated with the job;

determining that at least one of the one or more data transformations require a permission exceeding the permissions encoded in the token; and

communicating, to the second service, a response denying the request.

15. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors to perform:

receiving, from a client device associated with a user or from a service, a job associated with a project, wherein the project is associated with one or more data sources;

determining first permissions corresponding to the client device or the service and second permissions corresponding to a second client device or a second service, wherein:

each of the first permissions comprises an operation on a data source;

generating a token associated with the job, the token encoding the first permissions or the second permissions;

receiving a request from the client device or the service for the token;

determining whether the client device or the service is authorized to execute the job based on the first permissions;

in response to determining that the client device or the service is authorized to execute the job, granting the token to the client device or the service to enable the client device or the service to execute the job; and

in response to executing the job, selectively transmitting a result of the execution of the job to a different client device or a different service based on whether the different client device or the different service is authorized to access the result, based on the second permissions.

16. The non-transitory computer readable medium of claim 15 , wherein the job comprises one or more data transformations.

17. The non-transitory computer readable medium of claim 15 , wherein the one or more data sources associated with the project comprise:

one or more data sources internal to the project; or

one or more data sources external to the project, wherein the project comprises a reference to each of the one or more data sources external to the project.

18. The non-transitory computer readable medium of claim 15 , wherein the one or more required permissions comprise:

reading data from a data source external to the project; or writing to a data source external to the project.

19. The non-transitory computer readable medium of claim 15 , wherein the instructions that, when executed, cause one or more processors to perform:

obtaining a result associated with execution of the one or more data transformations;

verifying that the service possesses one or more access permissions associated with accessing the result; and

providing the result to the service.

20. The non-transitory computer readable medium of claim 15 , wherein the service comprises a first service, the request comprises a first request, and the instructions that, when executed, cause one or more processors to perform:

receiving, from a second service, a second request to execute one or more data transformations, wherein the second request comprises the token associated with the job;

determining that at least one of the one or more data transformations require a permission exceeding the permissions encoded in the token; and

communicating, to the second service, a response denying the request.

Assignments (1)

Continuity (3)

References Cited (11)