ROW-LEVEL PERMISSIONING BASED ON EVALUATED POLICIES
A computer system is disclosed that provides classification-based access controls at the dataset row-level. The system may perform operations including: ingesting a dataset, wherein the dataset comprises a table of rows and columns; determining a column of the table that includes permissions information; applying parsing rules to the column to determine, for each row of the table, a list of permissions markings; receiving, from a user, a request to access the dataset; and in response to receiving the request: determining a permissions policy associated with the user; determining an evaluated policy associated with the user based on the permissions policy; filtering the table based on applying the evaluated policy associated with the user to the permissions markings of each row of the table; and providing the user access to the filtered table.
1 . A computer system comprising:
one or more computer readable storage devices configured to store at least a plurality of computer readable instructions; and
one or more processors configured to execute the plurality of computer readable instructions to cause the computer system to perform operations comprising:
ingesting a dataset, wherein the dataset comprises a table of rows and columns;
parsing at least a column of the table to determine, for each row of the table, a list of permissions markings; and
in response to a request, from a user, to access the dataset:
determining permissions associated with the user;
determining an evaluated policy associated with the user based on the permissions, wherein the evaluated policy comprises a single expression;
filtering the table based on applying the evaluated policy associated with the user to the permissions markings of each row of the table; and
providing the user access to the filtered table.
2 . The computer system of claim 1 , wherein the filtering further comprises applying one or more filtering rules to the evaluated policy and the permissions markings, and wherein the filtering rules comprise a customizable set of filtering rules.
3 . The computer system of claim 1 , wherein the single expression comprises one or more logical operators.
4 . The computer system of claim 1 , wherein the single expression comprises a Boolean expression.
5 . The computer system of claim 1 , wherein the lists of permissions markings are determined from unstructured strings of permissions information.
6 . The computer system of claim 1 , wherein the operations further comprise:
receiving, from the user, a search query;
combining the evaluated policy associated with the user with the search query; and
filtering the filtered table based on the combined evaluated policy and search query.
7 . The computer system of claim 1 , wherein the operations further comprise:
providing one or more user interfaces configured to allow user-specification of one or more filtering rules, wherein user-specification of the filtering rules comprises specifying at least one of: a user attribute, a column of a dataset, or a specific value.
8 . A computer system comprising:
one or more computer readable storage devices configured to store at least a plurality of computer readable instructions; and
one or more processors configured to execute the plurality of computer readable instructions to cause the computer system to perform operations comprising:
ingesting a dataset, wherein the dataset comprises a set of data objects;
parsing one or more properties of the data objects to determine, for each data object, a list of permissions markings; and
in response to a request, from a user, to access the dataset:
determining permissions associated with the user;
determining an evaluated policy associated with the user based on the permissions, wherein the evaluated policy comprises a single expression;
filtering the set of data objects based on applying the evaluated policy associated with the user to the permissions markings of each data object of the set of data objects; and
providing the user access to the filtered set of data objects.
9 . The computer system of claim 8 , wherein the filtering further comprises applying one or more filtering rules to the evaluated policy and the permissions markings, and wherein the filtering rules comprise a customizable set of filtering rules.
10 . The computer system of claim 8 , wherein the single expression comprises one or more logical operators.
11 . The computer system of claim 8 , wherein the single expression comprises a Boolean expression.
12 . The computer system of claim 8 , wherein the lists of permissions markings are determined from unstructured strings of permissions information.
13 . The computer system of claim 8 , wherein the operations further comprise:
receiving, from the user, a search query;
combining the evaluated policy associated with the user with the search query; and
filtering the filtered set of data objects based on the combined evaluated policy and search query.
14 . The computer system of claim 8 , wherein the operations further comprise:
providing one or more user interfaces configured to allow user-specification of one or more filtering rules, wherein user-specification of the filtering rules comprises specifying at least one of: a user attribute, a column of a dataset, or a specific value.
15 . A computer-implemented method comprising:
ingesting a dataset, wherein the dataset comprises a table of rows and columns;
parsing at least a column of the table to determine, for each row of the table, a list of permissions markings; and
in response to a request, from a user, to access the dataset:
determining permissions associated with the user;
determining an evaluated policy associated with the user based on the permissions, wherein the evaluated policy comprises a single expression;
filtering the table based on applying the evaluated policy associated with the user to the permissions markings of each row of the table; and
providing the user access to the filtered table.
16 . The computer-implemented method of claim 15 , wherein the filtering further comprises applying one or more filtering rules to the evaluated policy and the permissions markings, and wherein the filtering rules comprise a customizable set of filtering rules.
17 . The computer-implemented method of claim 15 , wherein the single expression comprises one or more logical operators.
18 . The computer-implemented method of claim 15 , wherein the single expression comprises a Boolean expressions.
19 . The computer-implemented method of claim 15 , wherein the lists of permissions markings are determined from unstructured strings of permissions information.
20 . The computer-implemented method of claim 15 further comprising:
receiving, from the user, a search query;
combining the evaluated policy associated with the user with the search query; and
filtering the filtered table based on the combined evaluated policy and search query.