Granted Patent B2

US 12,627,672 · App. 18/773,300 · Granted May 12, 2026

Inventors: Peter Wilczynski (Denver, CO); Arseny Bogomolov (Arlington, VA); Alexander Mark (New York, NY); Teofana Hadzhiganeva (Bethesda, MD); Kevin Ng (New York, NY); Nathaniel Klein (Washington, DC); Sharon Hao (Redwood City, CA)

Assignee: Palantir Technologies Inc.

H04L63/104

Abstract

Claims (66)

1 . A method for providing granular access control, comprising:

receiving an embedded artifact including a first part and a second part, the first part being associated with a first access control policy, the second part being associated with a second access control policy, the second access control policy being different from the first access control policy;

receiving an association of the embedded artifact with a resource container, the first access control policy being a subset of an access control policy of the resource container;

receiving an access request to access the embedded artifact;

applying the first access control policy to determine whether the access request is grantable for the first part;

applying the second access control policy to determine whether the access request is grantable for the second part; and

in response to determining that the access request is grantable for the first part and the access request for the second part, granting the access request;

wherein the method is performed using one or more processors.

2 . The method of claim 1 , wherein the granting the access request comprises:

generating a redacted first part based on the first part and the first access control policy; and

granting an access to the redacted first part.

3 . The method of claim 2 , wherein the first part includes a first data that is omitted or changed in the redacted first part.

4 . The method of claim 1 , wherein the applying the first access control policy further comprises:

identifying a permission associated with a user group associated with a user for whom the access request is submitted; and

determining whether the permission matches an access type specified by the access request.

5 . The method of claim 1 , wherein the subset of the access control policy of the resource container includes an intersection of the access control policy of the resource container and an initial access control policy of the embedded artifact;

wherein the initial access control policy is retrieved based on an access control policy pointer in metadata of the embedded artifact.

6 . The method of claim 1 , further comprising:

creating a copy of the subset of the access control policy;

associating the embedded artifact with the copy of the subset of the access control policy; and

disassociating the embedded artifact from the resource container.

7 . The method of claim 1 , further comprising:

creating a restrictive version of the first access control policy;

associating the embedded artifact with the restrictive version of the first access control policy;

redacting the embedded artifact to generate a redacted embedded artifact based on the restrictive version of the first access control policy; and

sharing the redacted embedded artifact with a user that is authorized to access the embedded artifact based on the restrictive version of the first access control policy.

8 . A system for providing granular access control, comprising:

one or more memories comprising instructions stored thereon; and

one or more processors configured to execute the instructions and perform operations comprising:

receiving an embedded artifact including a first part and a second part, the first part being associated with a first access control policy, the second part being associated with a second access control policy, the second access control policy being different from the first access control policy;

receiving an association of the embedded artifact with a resource container, the first access control policy being a subset of an access control policy of the resource container;

receiving an access request to access the embedded artifact;

applying the first access control policy to determine whether the access request is grantable for the first part;

applying the second access control policy to determine whether the access request is grantable for the second part; and

in response to determining that the access request is grantable for the first part and the access request for the second part, granting the access request.

9 . The system of claim 8 , wherein the granting the access request comprises:

generating a redacted first part based on the first part and the first access control policy; and

granting an access to the redacted first part.

10 . The system of claim 9 , wherein the first part includes a first data that is omitted or changed in the redacted first part.

11 . The system of claim 8 , wherein the applying the first access control policy further comprises:

identifying a permission associated with a user group associated with a user for whom the access request is submitted; and

determining whether the permission matches an access type specified by the access request.

12 . The system of claim 8 , wherein the subset of the access control policy of the resource container includes an intersection of the access control policy of the resource container and an initial access control policy of the embedded artifact;

wherein the initial access control policy is retrieved based on an access control policy pointer in metadata of the embedded artifact.

13 . The system of claim 8 , wherein the operations further comprise:

creating a copy of the subset of the access control policy;

associating the embedded artifact with the copy of the subset of the access control policy; and

disassociating the embedded artifact from the resource container.

14 . The system of claim 8 , wherein the operations further comprise:

creating a restrictive version of the first access control policy;

associating the embedded artifact with the restrictive version of the first access control policy;

redacting the embedded artifact to generate a redacted embedded artifact based on the restrictive version of the first access control policy; and

sharing the redacted embedded artifact with a user that is authorized to access the embedded artifact based on the restrictive version of the first access control policy.

15 . A non-transitory computer readable storage medium comprising executable instructions for providing granular access control that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving an embedded artifact including a first part and a second part, the first part being associated with a first access control policy, the second part being associated with a second access control policy, the second access control policy being different from the first access control policy;

receiving an association of the embedded artifact with a resource container, the first access control policy being a subset of an access control policy of the resource container;

receiving an access request to access the embedded artifact;

applying the first access control policy to determine whether the access request is grantable for the first part;

applying the second access control policy to determine whether the access request is grantable for the second part; and

in response to determining that the access request is grantable for the first part and the access request for the second part, granting the access request.

16 . The non-transitory computer readable storage medium of claim 15 , wherein the granting the access request comprises:

generating a redacted first part based on the first part and the first access control policy; and

granting an access to the redacted first part.

17 . The non-transitory computer readable storage medium of claim 15 , wherein the applying the first access control policy further comprises:

identifying a permission associated with a user group associated with a user for whom the access request is submitted; and

determining whether the permission matches an access type specified by the access request.

Assignments (2)

Continuity (6)

References Cited (101)