A method for a computer system storing electronic objects being defined by metadata comprising one or more properties having values, wherein one or more of the electronic objects are associated with an access control list, said access control list defining a user of a client device authorized to access an electronic object and operations the user is authorized to perform on said electronic object, wherein the method comprises - receiving a request to access an electronic object of said electronic objects from a client device; and - as a response to the received request, permitting the user of the client device to access the electronic object according to said access control list; the method further comprising - said electronic object referring by a property value of the metadata of said electronic object to a security component comprising an attribute and access rights defined for said attribute; characterized in that the method further comprises - identifying a user being allowed to access the electronic object from a metadata property value of another object, which another object is determined using the attribute, wherein said attribute is being formed of at least a first part defining a referring object and a second part defining a chain of references to properties of objects starting from said referring object, wherein a value of the referred-to property in the chain of references defines the next object having the next referred-to property, wherein the second-last reference in the chain of references defines said another object, and the last reference of the chain of references defines a property of said another object having a value that defines the user; and - propagating the security component to the access control list of said electronic object to give said access rights to the identified user. - receiving a request to access an electronic object of said electronic objects from a client device; and - as a response to the received request, permitting the user of the client device to access the electronic object according to said access control list; the method further comprising - said electronic object referring by a property value of the metadata of said electronic object to a security component comprising an attribute and access rights defined for said attribute; characterized in that the method further comprises - identifying a user being allowed to access the electronic object from a metadata property value of another object, which another object is determined using the attribute, wherein said attribute is being formed of at least a first part defining a referring object and a second part defining a chain of references to properties of objects starting from said referring object, wherein a value of the referred-to property in the chain of references defines the next object having the next referred-to property, wherein the second-last reference in the chain of references defines said another object, and the last reference of the chain of references defines a property of said another object having a value that defines the user; and - propagating the security component to the access control list of said electronic object to give said access rights to the identified user. - identifying a user being allowed to access the electronic object from a metadata property value of another object, which another object is determined using the attribute, wherein said attribute is being formed of at least a first part defining a referring object and a second part defining a chain of references to properties of objects starting from said referring object, wherein a value of the referred-to property in the chain of references defines the next object having the next referred-to property, wherein the second-last reference in the chain of references defines said another object, and the last reference of the chain of references defines a property of said another object having a value that defines the user; and - propagating the security component to the access control list of said electronic object to give said access rights to the identified user.