Patent ID: 7127461

Claim:
A computer-implemented method for accessing objects using security rules, comprising: receiving from a user a request to perform an action with respect to an object; identifying groups to which the user is a member; identifying containers associated with the identified groups; from the containers identified as being associated with the identified groups, identifying the containers that allow the requested action, and, for each of the containers identified as allowing the requested action, identifying the security rules associated with each of these containers; and translating the identified security rules to identify a first set of objects that have an allowed status; and identifying the containers that deny the requested action, and, for each of the containers identified as denying the requested action, identifying the security rules associated with each of these containers; and translating the identified security rules to identify a second set of objects that have a deny status; and subtracting the second set of objects from the first set of objects to produce a resultant set of objects; and providing access to the object for the requested action if the object is contained in the resultant set of objects.