Patent ID: 8375439

Claim:
A method comprising: determining, in an operating system instance, that a first login access is being attempted by a first user at a first access time on an object and that a second login access is being attempted by a second user at a second access time on the object; determining a first domain identifier associated with the first user and a second domain identifier associated with the second user, wherein the first domain identifier identifies a first domain and the second domain identifier identifies a second domain, the first and second domains respectively representing a first organizational entity and a second organization entity of a plurality of domains representing a plurality of organizational entities; accessing a set of one or more domain identifiers associated with the object, wherein the set identifies one or more domains of the plurality of domains representing one or more organizational entities of the plurality of organizational entities; accessing one or more domain isolation rules associated with the operating system instance for permitting an attempted login access to the object during at least a first time period of a plurality of time periods by one or more domains based on whether a domain identifier associated with the first user is one of the domain identifiers in the set of domain identifiers associated with the object for during the first time period; evaluating the one or more domain isolation rules to determine whether the first login access is permitted on the object at the first access time; returning a permit indication that the first login access is permitted on the object if the domain isolation rules indicate that the first domain identifier represents a domain that is permitted for the object at the first access time and if the first access time is during the first time period, and returning a deny indication that the first login access is not permitted on the object if the domain isolation rules indicate that the first domain identifier represents a domain that is not permitted for the object at the first access time and if the first access time is during a second time period different from the first time period and the first domain identifier is not one of the domain identifiers in the set of domain identifiers associated with the object for during the second time period; evaluating the one or more domain isolation rules to determine whether the second login access is permitted on the object at the second access time; returning the permit indication for the second user if the second access time is during the second time period and the second domain identifier is one of the domain identifiers in the set of domain identifiers associated with the object for during the second time period, and returning the deny indication if the second access time is during the first time period and the second domain identifier is not one of the domain identifiers in the set of domain identifiers associated with the object for during the first time period.