Patent ID: 8561146

Claim:
A computer-implemented method for controlling data access by users of a file system, comprising the steps of: receiving a request for a change in user access rights of one of said users to a designated storage element of said file system, wherein said file system comprises storage elements including said designated storage element, each of said storage elements being owned by a single owner that controls said user access rights thereto, and a user repository including groups of said users, wherein users in each of said groups have common access rights to said storage elements; identifying one of said groups, wherein said identified group has a group owner that controls said membership thereof; establishing at least one group authorizer to act on behalf of said group owner; obtaining a consent to said request from said owner of said designated storage element; obtaining a concurrence from said at least one group authorizer of said identified group to change said membership of said one user therein; and responsively to said consent and to said concurrence, conforming said user access rights of said one user to said designated storage element to said request by granting said user membership in said identified group or by revoking from said user membership in said identified group.