Patent ID: 11870786
Assignee: SAP SE
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 12:
13. A system comprising:
one or more computers; and
a computer-readable medium coupled to the one or more computers having instructions stored thereon which, when executed by the one or more computers, cause the one or more computers to perform operations comprising:
receiving, at a cloud application, a first request associated with a first user, wherein the first user request corresponds to a first instance of a first artifact type;
determining that a first instance-based access policy exists for the first artifact type, the first instance-based access policy comprising a matching rule that selectively enables access to instances of the first artifact type;
evaluating the matching rule with respect to the first instance to determine whether the first instance-based access policy grants permission for the first user to access the first instance;
in response to determining that the first instance-based access policy grants permission for the first user to access the first instance, servicing the first request; and
in response to determining that the first instance-based access policy does not grant permission for the first user to access the first instance, denying the first request.