Patent ID: 7370344

Claim:
A computer-implemented method for accessing resource objects that are stored in an object database, comprising the steps of: receiving a request from a requestor which involves accessing a resource object that is stored in the object database; wherein the requested resource object has multiple associations with other objects that are stored in the object database; wherein the multiple associations with said other objects comprise a network of object associations that establish the requested resource objects having multiple parents; evaluating identity of the requestor with respect to access controls placed on the requested resource object for establishing an authorization decision with respect to the resource object; wherein if the examining of the requestor's identity with respect to the resource object access controls does not result in establishing an authorization decision, then: evaluating container objects, which are the parents of the requested object, within a security containment boundary for establishing an authorization decision with respect to the resource object; wherein security containment rules are security rules that specify which associations form the security containment boundary for objects based on object class; wherein the associations specified by the security containment rules are used to determine which of the multiple associated objects, that are parents of the requested object, form the security containment boundary; wherein the request to the resource object is processed based upon security access control information associated with the container objects contained within the determined security containment boundary.