Patent ID: 7870156

Claim:
A system, comprising at least one processor and operatively associated data storage, the data storage comprising instructions that, when executed by the at least one processor, causes the at least one processor to implement: a centralized organizational information system that manages and stores organizational data at a centralized organizational information database, wherein the organizational data comprises: user identity data describing a plurality of user identities; relationship data describing a plurality of relationships, wherein each relationship defines a relationship between at least one user identity selected from the plurality of user identities and a group of user identities selected from the plurality of user identities; role data describing a plurality of roles, wherein each role defines a job function assigned to at least one user identity selected from the plurality of user identities; and coverage data describing a plurality of coverages, wherein each coverage defines a scope of responsibility of at least one user identity selected from the plurality of user identities, with respect to an associated role, and wherein the coverages comprise one or more coverage attributes selected from data describing at least one of a line of business, a product, a client and a data management system; a plurality of entitlements engines in communication with the organizational information system, and with applications that use secured resources, wherein each of the entitlements engines is configured to service at least one of the applications, wherein each of the entitlements engines is in communication with an entitlement database associated with the entitlements engine and, wherein each of the plurality of entitlements engines is configured to: read data from the organizational information system, wherein the read data comprises role data indicative of an assigned job function and coverage data indicative of an assigned scope of responsibility; receive at least one executable entitlement rule; apply the at least one entitlement rule to the read data to create entitlement data, wherein the at least one entitlement rule specifies access policies that define, for at least one of the secured resources, an access policy based on a role selected from the plurality of roles and a coverage selected from the plurality of coverages; store the entitlement data in the entitlements database associated with the entitlements engine, wherein the entitlement data is indicative of the user, the at least one of the secured resources and an action upon the at least one of the secured resources; receive a query from one of the applications requesting an indication of whether the user of the application is authorized to access the at least one of the secured resources that is used by the application; generate a response to the query considering the entitlement data.