Patent ID: 11888853
Assignee: CAPITAL ONE SERVICES, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 18:
19. A non-transitory computer-accessible medium having stored thereon computer-executable instructions for dynamic and granular user access permissions, wherein upon execution by a computer arrangement comprising a processor, the instructions cause the computer arrangement to perform procedures comprising:
providing a database interface to an access control permissions database that stores at least one of roles, actions, or policies for users;
providing a user interface for a first user of the users, wherein the user interface includes a user management process that provides tools for adding, updating, and deleting users, and the management process changes the permanent access permissions in the access permission database;
providing the user interface including only actions that are permitted for the first user, and at least one of the actions is modified on the user interface based on a temporal limitation;
providing a login process that authenticates the first user and determines a default set of access control permissions for the first user for the user interface, wherein the default access control permissions are role-based authorizations;
accessing permanent access control permissions for the first user using the database interface, wherein the permanent access control permissions are role-based authorizations that determine a level of access the first user has, and the users are assigned to roles that align with their roles in an organization's hierarchy or the application;
providing an event handler that dynamically modifies access to functionality in the user interface based on an event creating at least one temporary access control permission, wherein the at least one temporary access control permission is a scope limited or a temporally limited attribute-based authorization based on one or more policies created to determine a non-role-based authorization the user has within the application, wherein the one or more policies include a policy based on a business rule that the first user is not allowed to edit product descriptions during a specific time, and the one or more policies fit into a pattern for the application and logic is used to make determinations about a user's access permission based on the pattern; and
providing an authorization process that determines whether a request from the user interface is authorized before processing the request from an administrator, using the permanent access control permissions from the administrator, and the at least one temporary access control permission, wherein:
the attribute-based authorization provides a level of authority that is tied to the one or more policies associated with the application and is independent of the user roles within the organization's hierarchy or application,
the level of authority determines what authorization the first user has within the application, and
the application comprises an administration application configured to expand, create, or limit role-based access permissions without having to add new roles or updates to a front end application, which allows configurable permutations of roles per user and per component as the application evolves over time.