Patent ID: 7774365

Claim:
A computer-implemented entitlement system for controlling access to secured resources of an organization, the entitlement system comprising at least one processor and operatively associated data storage comprising instructions that, when executed by the at least one processor, cause the entitlement system to implement: a computer-implemented organizational information system that manages and stores organizational data at an organizational information database, wherein the organizational data is stored in the organizational information database according to a logical data model that comprises: user identities; teams, wherein each team is associated with at least one of the user identities; relationships, wherein each relationship defines a relationship between at least one of the user identities and at least one of the teams or between at least two of the teams; roles, wherein each role defines a job function assigned to at least one of the teams or to at least one of the user identities; and coverages, wherein each coverage defines a scope of responsibility of at least one of the teams or of at least one of the user identities that is associated with at least one of the teams, with respect to an associated one of the roles, and wherein each coverage comprises one or more coverage attributes selected from at least one of data describing a line of business, a product, a client and a system; a plurality of entitlements engines in electronic communication with the organizational information system, and with applications that use secured resources, and wherein each entitlements engine is configured to service at least one of the applications and comprises: an entitlements database; a store of business rules logic; an integrator, wherein the integrator is programmed to: read data from the organizational information system wherein the read data comprises user identity data, role data indicative of an assigned job function and coverage data indicative of an assigned scope of responsibility; apply the business rules logic to the read data to create entitlement data, wherein the business rules logic specifies access policies that define, for at least one of the secured resources, an access policy based on a role selected from the roles and at least one of the coverages; and store the entitlement data in the entitlements database, wherein the entitlement data is indicative of a user, the at least one of the secured resources, and an action performed regarding the at least one of the secured resources; and wherein each of the plurality of entitlements engines is programmed to: receive a query from one of the applications requesting an indication of whether the user of the application is authorized to access at least one of the secured resources that is used by the application; and generate a response to the request considering the entitlement data.