Patent ID: 7644086

Claim:
A computer-implemented method for accessing resource objects, comprising: receiving a request using one or more computer processors to perform an operation upon a resource object, wherein the request corresponds to access credential information associated with an identity and group membership, the access credential information including group membership priority information identifying a precedential order to be applied to the group membership by authorization precedence rules, wherein the resource object is associated with multiple other resource objects, authorization-related objects configured to specify whether access should be granted or denied to a requested object, and access permission information, and wherein association information is stored in one or more data stores; using the authorization precedence rules to establish a precedential order based upon the particular identity and group membership associated with the request, wherein group membership includes one or more levels of membership, and wherein establishing a precedential order includes prioritizing values associated with levels such that lower values have priority over higher values in the precedential order; querying the one or more data stores to determine which authorization-related objects are associated with the requested resource object; querying the one or more data stores to determine which access permission information is associated with the determined authorization-related objects; performing a comparison between the determined access permission information and the access credential information corresponding to the request, wherein the performing a comparison includes applying the precedential order to the access credential information corresponding to the request to determine if authorization to the requested resource object is granted or denied; and wherein if the comparison does not result in a determination of whether to permit the operation with respect to the resource object, then inheritance operations are performed, the inheritance operations including: evaluating at least one security rule to determine whether to grant authorization to the requested resource object, the requested resource object having multiple associations with other objects, using the evaluated at least one security rule to determine a security containment boundary based upon an association between the requested resource object and another object, wherein determining a security containment boundary includes setting up security rules based on object class, and specifying how to traverse from an object of a class to an associated object, determine authorization information from the traversal, using the authorization information with identity information corresponding to a requester to determine whether to grant authorization to the requested resource object, and processing the request to the resource object based upon security access control information associated with the objects contained within the determined security containment boundary.