Patent ID: 8555055

Claim:
A computer-implemented role-based delegation system, comprising: one or more processing units; and a memory subsystem operatively coupled to the processing units and comprising a role-based security framework that includes roles in a containment hierarchy, the containment hierarchy including existing roles and derived roles, the derived roles derived from the existing roles, wherein an existing role includes actions and action parameters that define access to resources, and a derived role includes equal or fewer of the actions and action parameters of the existing role from which the derived role is generated, and wherein the actions and action parameters of the derived role can be removed and added back, not to exceed the actions and action parameters of the existing role from which the derived role is generated, a delegation component configured to create and configure a delegating assignment to a first role, the delegating assignment indicating the capability to delegate the first role to other users, and create and configure a non-delegating assignment for a second role that prevents delegation of the second role to other users, and a scope component configured to define a scope of the delegating assignment.