Patent ID: 8234299

Claim:
A computer-implemented method for controlling access to data stored in a table of a database, wherein the computer performs the functions in the following method, the method comprising: marking the table of the database as being protected with fine-grained access control (FGAC); creating a system authorization class for the table of the database, the system authorization class having a default row-level authorization that prevents access to all rows in the table, the system authorization class being unmodifiable; creating a user authorization class for the table of the database, the user authorization class having a default row-level authorization that prevents access to all rows in the table, the user authorization class being modifiable wherein the user authorization class is provided as a location for any authorizations for which no authorization class is specified; associating the system authorization class and the user authorization class with the table of the database, wherein the association of the system authorization class with the table of the database operates to deny access to the rows and columns of the table; receiving a request from a user seeking to access data in the table of the database; determining whether any other user authorization class is applicable to the user; responsive to no other user authorization class being applicable to the user, determining whether the system authorization class and the user authorization class are defined as intersecting classes; responsive to the system authorization class and the user authorization class being defined as intersecting classes, preventing the user from accessing any row in the table of the database; responsive to the system authorization class and the user authorization class not being defined as intersecting classes, permitting the user to access rows or columns in the table of the database based on the union of authorizations.