Patent ID: 7793333

Claim:
A method, in a data processing system, for mobile authorization using policy based access control, the method comprising: collecting a plurality of policies for a remote device to form a set of collected policies; transforming the set of collected policies for the remote device to form a set of simplified policies for the remote device; wherein transforming the set of collected policies comprises: filtering out any collected policy that includes a policy action group specifying a set of actions if the set of actions is not available on the remote device; filtering out any collected policy that includes a policy member group if no users within a set of users of the remote device are in the policy member group; filtering out any collected policy that includes a policy resource group if one or more resources available to the remote device are not members of the policy resource group; and filtering out any collected policy that specifies a relationship between a user and a resource if the user does not have the specified relationship with the resource available to the remote device; sending the set of simplified policies to the remote device; receiving the set of simplified policies and one or more resources at the remote device; responsive to a request to perform an action during an off-line mode at the remote device, checking a current user of the remote device, the one or more resources and the action against the set of simplified policies; granting the action at the remote device if the current user, the one or more resources and the action passes the check; and denying the action at the remote device if the current user, the one or more resources and the action fails the check.