Patent ID: 8326874

Claim:
A computer-implemented method for checking access of a user to perform an operation on an object, the method comprising: receiving a method call that involves an access of the object by the user, wherein the object and user are part of a data-driven model that allow marking a relationship type in the model between an accessor object class and an accessed object class as an authorization relationship type and wherein the authorization relationship type defines one or more permissions granted to the accessor object on the accessed object without specifying a particular user or group of users; retrieving the model operation associated with the received method call; retrieving a user token of the user that called an application programming interface (API); determining whether the user has explicit access to perform the requested operation; and in response to determining that the user does not have explicit access to perform the requested operation, identifying one or more roles associated with the user and one or more profiles associated with the roles; and upon identifying a role through which the user has permission to perform the operation, implicitly granting the user the requested access to perform the operation such that the user receives access permission dynamically based on the data-driven model without explicit authorization of the user or group membership management, wherein determining whether the user has explicit access to perform the requested operation comprises determining the user's access based on the user's identity or group memberships defined by the user's token; wherein the preceding steps are performed by at least one processor.