Hierarchical permissions model for case management
Case management systems and techniques are disclosed. In various embodiments, a case model definition defining a case model is received. The case model comprises a hierarchical permissions model comprising a plurality of hierarchical permission nodes, the plurality of hierarchical permission nodes including a first hierarchical permission node associated with a parent case node and having an associated first case role and a first permission for the first role, and a second hierarchical permission node associated with a child case node. At run time, the first permission with respect a case instance instantiated using the case model definition is enforced. Enforcing the first permission comprising applying the first permission to a request to perform a first action on an instance of the child case node based on the first case role and first permission.
1. A non-transitory computer readable medium embodying thereon computer executable code, the computer executable code comprising instructions for:
obtaining a case model definition, the case model definition defining a case model comprising:
a data model comprising a plurality of related case nodes, the plurality of case nodes comprising a first case node and a second case node that is related to the first case node; and
a permissions model, the permissions model comprising a plurality of permission definitions associated with related case nodes, the plurality of plurality of permission definitions including:
a first permission definition associated with the first case node, defining a first permission for the associated first case node;
a second permission definition associated with the second case node, defining a second permission for the associated second case node;
at run time, enforcing the first permission with respect to a case instance instantiated using the case model definition, wherein enforcing the first permission comprising applying the first permission in association with performing a first action on an instance of the first case node based on the first permission definition associated with the first case node.
2. The non-transitory computer readable medium of claim 1 , wherein the first permission defines a permission with respect to content or metadata associated with the first case node for that case instance.
3. The non-transitory computer readable medium of claim 1 , wherein the first permission defines which users have permission to add or remove content for the first case node.
4. The non-transitory computer readable medium of claim 1 , wherein the first permission differs based on a state of an associated state machine for the first case node.
5. The non-transitory computer readable medium of claim 1 , wherein the first permission is defined based on a case role associated with the first case node.
6. The non-transitory computer readable medium of claim 1 , wherein the first case node is a child of the second case node and the first permission definition is a child of the second permission definition.
7. The non-transitory computer readable medium of claim 6 , wherein enforcing the second permission with respect to the case instance by applying the second permission in association with performing the first action on the instance of the first case node is based on the first case node being a child of the second case node.
8. A method, comprising:
obtaining a case model definition, the case model definition defining a case model comprising:
a data model comprising a plurality of related case nodes, the plurality of case nodes comprising a first case node and a second case node that is related to the first case node; and
a permissions model, the permissions model comprising a plurality of permission definitions associated with related case nodes, the plurality of plurality of permission definitions including:
a first permission definition associated with the first case node, defining a first permission for the associated first case node;
a second permission definition associated with the second case node, defining a second permission for the associated second case node;
at run time, enforcing the first permission with respect to a case instance instantiated using the case model definition, wherein enforcing the first permission comprising applying the first permission in association with performing a first action on an instance of the first case node based on the first permission definition associated with the first case node.
9. The method of claim 8 , wherein the first permission defines a permission with respect to content or metadata associated with the first case node for that case instance.
10. The method of claim 8 , wherein the first permission defines which users have permission to add or remove content for the first case node.
11. The method of claim 8 , wherein the first permission differs based on a state of an associated state machine for the first case node.
12. The method of claim 8 , wherein the first permission is defined based on a case role associated with the first case node.
13. The method of claim 8 , wherein the first case node is a child of the second case node and the first permission definition is a child of the second permission definition.
14. The method of claim 13 , wherein enforcing the second permission with respect to the case instance by applying the second the permission in association with performing the first action on the instance of the first case node based on the first case node being a child of the second case node.
15. A system, comprising:
a processor;
a non-transitory computer readable medium, comprising instructions for:
obtaining a case model definition, the case model definition defining a case model comprising:
a data model comprising a plurality of related case nodes, the plurality of case nodes comprising a first case node and a second case node that is related to the first case node; and
a permissions model, the permissions model comprising a plurality of permission definitions associated with related case nodes, the plurality of plurality of permission definitions including:
a first permission definition associated with the first case node, defining a first permission for the associated first case node;
a second permission definition associated with the second case node, defining a second permission for the associated second case node;
at run time, enforcing the first permission with respect to a case instance instantiated using the case model definition, wherein enforcing the first permission comprising applying the first permission in association with performing a first action on an instance of the first case node based on the first permission definition associated with the first case node.
16. The system of claim 15 , wherein the first permission defines a permission with respect to content or metadata associated with the first case node for that case instance.
17. The system of claim 15 , wherein the first permission defines which users have permission to add or remove content for the first case node.
18. The system of claim 15 , wherein the first permission differs based on a state of an associated state machine for the first case node.
19. The system d of claim 15 , wherein the first permission is defined based on a case role associated with the first case node.
20. The system of claim 15 , wherein the first case node is a child of the second case node and the first permission definition is a child of the second permission definition.
21. The system of claim 20 , wherein enforcing the second permission with respect to the case instance by applying the second the permission in association with performing the first action on the instance of the first case node based on the first case node being a child of the second case node.