Patent ID: 8453198

Claim:
A method of policy-based, delegated network access management, comprising: for each discovered access control entry (ACE) sequence of a plurality of discovered ACE sequences, during a discovery process: determining whether the discovered ACE sequence is stored in a legacy profile or associated with legacy profiles by an access control list (ACL) reference; assigning to the discovered ACE sequence a network access role (NAR) determined by whether the discovered ACE sequence matches, either exactly, partially, or not at all, an existing NAR, and whether the discovered ACE sequence is a valid expression; during a policy establishment process: establishing one or more policies to manage one or more user groups based upon the NARs discovered and assigned to ACE sequences during the discovery process; a network access administrator delegating management of the one or more user groups and the one or more established policies to one or more resource access administrators responsible for administering the one or more user groups and the one or more policies; and during a delegated provisioning process: the one or more resource access administrators administering network access by allocating NARs that have been approved by the network access administrator.