Patent ID: 7783616

Claim:
A method of controlling access to a hierarchically organized collection of data elements, comprising: receiving a document used in defining said data elements, said document including an entitlement ID as an attribute within a definition of a data element or optionally an attribute within a definition of one or more ancestor elements of the data element, wherein the entitlement ID governs access to the data elements and refers to an entitlement expression describing an entitlement group comprising classes of users allowed to access the data elements, and wherein the document is a single document that comprises the entitlement ID, the entitlement group and the data element; examining in succession said data element and optionally said one or more ancestor elements of the data element to determine an entitlement status for the element; consulting said entitlement ID to determine the entitlement group corresponding to the entitlement status; consulting a membership map to determine whether a selected user is a member of the entitlement group, wherein the membership map comprises a matrix of users and group memberships; and allowing the user to access the data element only if the user is a member of the entitlement group.