Patent ID: 7904560

Claim:
A computer system comprising: a processor; a memory unit that stores instructions associated with an application executed by the processor; and an interconnect coupling the processor and the memory unit, enabling the computer system to execute the application and perform operations of: establishing an administrative domain for a network that has an associated set of assets and an associated set of users; identifying at least one asset of the set of assets to be included in the administrative domain, each asset having at least one asset type, wherein each asset represents at least one of a software resource and a hardware resource detectable by a network, wherein identifying at least one asset of the set of asset to be included in the administrative domain comprises: registering the at least one asset with the administrative domain, wherein registering the at least one asset avails the at least one asset of services provided by the administrative domain; identifying at least one user of the set of users to be included in the administrative domain; establishing a set of roles within the administrative domain, each role defining at least one permission between a user and an asset in the administrative domain; detecting that a user is no longer associated with the administrative domain, the user having previously been assigned a role within the administrative domain; and in response to detection, disassociating the role from the user in order to revoke any permissions in which the role assigned to the user provided, wherein disassociating the role from the user assures that the user can no longer interact with assets in the administrative domain.