Patent ID: 11888853
Assignee: CAPITAL ONE SERVICES, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 10:
11. A method, comprising:
storing permanent access control permissions for users of an application in a database, wherein the permanent access control permissions are role-based authorizations that determine a level of access the users have within the application, and the users are assigned to roles that align with their roles in an organization's hierarchy or the application;
providing a user interface configured to receive one or more credentials used to authenticate a first user of the users, wherein the user interface includes a user management process that provides tools for adding, updating, and deleting users, and the management process changes the permanent access permissions in the access permission database;
providing the user interface including only actions that are permitted for the first user, and at least one of the actions is modified on the user interface based on a temporal limitation;
determining a set of temporary access permissions for the first user based on the respective permanent access control permissions, after an authentication of a first user, wherein the set of temporary access permissions are role-based authorizations;
providing an event handler that dynamically modifies at least one temporary access permission for the first user by applying to the first user at least one selected access control permission from a group of a scope limited access control permission and a temporally limited access control permission, wherein the selected access control permission is an attribute-based authorization based on one or more policies created to apply a non-role-based authorization for the first user within the application, wherein the one or more policies include a policy based on a business rule that the first user is not allowed to edit product descriptions during a specific time, and the one or more policies fit into a pattern for the application and logic is used to make determinations about a user's access permission based on the pattern; and
providing an authorization process that determines whether a request from the user interface is authorized before processing the request from an administrator, using the temporary access permissions, and the at least one selected access control permission, wherein:
the attribute-based authorization provides a level of authority that is tied to the one or more policies associated with the application and is independent of the user roles within the organization's hierarchy or application, the level of authority determines what authorization the first user has within the application, and
the application comprises an administration application configured to expand, create, or limit role-based access permissions without having to add new roles or updates to a front end application, which allows configurable permutations of roles per user and per component as the application evolves over time.