Patent ID: 11863563
Assignee: AMAZON TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 4:
5. A computer-implemented method, comprising:
determining a set of actions performed over a period of time on a set of resources in a multi-tenant environment, the actions performed using access granted according to permissions of a first access policy;
generating a second access policy granting permission for access corresponding to the actions previously performed during the period of time and denying permission for access corresponding to a subset of actions of the set;
evaluating the second access policy to check that the second access policy does not restrict access for all actions to one or more of the set of resources previously allowed under the first access policy;
verifying, using a policy logic, that any change in scope of the permissions as granted in the second access policy does not violate the permissions of the first access policy;
storing the second access policy for implementation with respect to the set of resources;
providing the second access policy as a recommendation with respect to the set of electronic resources;
determining that permission for access should be granted corresponding to at least one of the subset of actions after denying permission for access corresponding to the subset of actions; and
modifying the second access policy to permit access corresponding to the at least one of the subset of actions.