Patent ID: 8839344

Claim:
One or more computer-readable storage memories comprising executable instructions to perform a method of analyzing an access policy, the method comprising: abducing a set that comprises an assumption from information that comprises: (a) an access query that evaluates to true or false depending on whether access to a resource is granted, and (b) one or more rules that govern access to said resource; comparing said set with a plurality of tokens stored in a token store; identifying a first one of said plurality of tokens based on a first finding that said first one of said plurality of tokens does not satisfy said set but has a similarity to said set; comparing said set with a meta-policy, said meta-policy being separate from said access policy, said meta-policy specifying that said access policy is not allowed to permit access to any principal who is not a member of a first group, said meta-policy also specifying a set of proofs that are sought to meet a goal, said meta-policy also specifying a set of unwanted proofs that are not allowed under said access policy, said meta-policy further specifying a set of conditions that are to be un-satisfiable under said access policy; determining whether said set contains any assumptions that correspond to tokens that, when presented to a guard of said resource, would allow a principal who is not a member of said first group to access said resource; and providing, to a person, a result that is based on said first one of said plurality of tokens.