Patent ID: 6950825

Claim:
A method of providing role-based access in a networked computer system, said computer system comprising a plurality of objects on which users wish to perform operations, said method comprising the steps of: organizing said computer system objects into a hierarchical tree structure having a plurality of parent-child object relationships, each of said computer system objects representing a computer system resource to which access is to be controlled, said hierarchical tree having a topmost parent object, and each child object having one or more ancestor objects towards and including said topmost parent object; providing a Role Permission portion of a security policy in which operations on said computer system objects are grouped into permission collections and are assigned to corresponding security roles, said Role Permission portion defining a unidirectional inheritance definition such that when a particular role is applied to a certain level in said hierarchical tree structure, the scope of permitted access for that role is determined according to said inheritance definition and said parent-child object relationships; providing a Role Assignment portion of a security policy in which a plurality of users are assigned a security role and a hierarchy level, said Role Assignment portion and said Role Permission portion being independent of each other; and responsive to an operation request from a requesting user, evaluating said Role Permission and Role Assignment portions of the security policy, and granting permission for said operation request only if said operation is permitted at said request user's assigned role and system hierarchy level or if said operation is permitted via said inheritance definition at another system hierarchy level.