Patent ID: 7506364

Claim:
A computer-readable storage medium encoded with instructions that cause a computer to: receive an authorization query regarding a request to access a resource; identify a principal requesting to access the resource, wherein the principal is an application program; perform an access control check to determine whether to deny authorization to access the resource, the access control check being based on the principal and a policy applicable to the principal, wherein the policy is maintained as part of a centralized policy store and the policy comprises one or more rules; and responsive to determining to deny authorization to access the resource, identify a rule in the policy that caused the denial of authorization to access the resource; and determine whether learning mode is enabled for the identified rule; responsive to determining that learning mode is enabled for the identified rule, return an allow decision that would otherwise be denied, the allow decision granting authorization to access the resource, such that the effects of the principal accessing the resource may be evaluated; and enter an entry into a report log, the entry recording an indication of the rule having the enabled learning mode, wherein the instructions are executed as an integral component of an operating system suitable for executing on the computer.