Patent ID: 7752161

Claim:
An access administration system that accesses a database upon a second access request, following a first access request, said system comprising: a computer, wherein said computer comprises: an access requesting apparatus of said computer that provides said first and second access requests, each of said first and second access requests being associated with a set of conditions, each of said set of conditions including a condition having a plurality of positive subconditions linked only by a Boolean operator of either a conjunctive, AND, or a disjunctive, OR; a policy determination apparatus of said computer; an access processor of said computer that permits access to said database; and an access administration apparatus of said computer comprising: a decision storage unit of said computer that stores a first set of decisions associated with said first access request, said first set of decisions corresponding to satisfaction of each of a plurality of first subconditions and to satisfaction of said predetermined accession permission condition, wherein said predetermined access permission condition corresponds to a predetermined set of conditions, each of said predetermined set of conditions including a predetermined condition having a predetermined plurality of positive subconditions linked only by a Boolean operator of either a conjunctive, AND, or a disjunctive, OR; a subcondition-based determination unit of said computer that receives said second access request and determines whether each of a plurality of second subconditions, associated with said second access request, is satisfied; an inclusion relation determination unit of said computer that receives a second set of decisions, corresponding to satisfaction of said each of said plurality of second subconditions, from said subcondition-based determination unit, said inclusion relation determination unit determining whether said second set of decisions is logically included by said first set of decisions, wherein said second set of decisions differs from said first set of decisions by satisfaction of at least one of said plurality of subconditions; and a decision acquisition unit of said computer that communicates with said access processor to permit access to said database, if said second set of decisions is logically included by said first set of decisions, and that sends said second set of decisions to said policy determination apparatus, if said second set of decisions is not logically included by said first set of decisions, receives a decision as to whether said second set of decisions satisfies said predetermined accession permission condition from said policy determination apparatus, and communicates said decision to said access processor, wherein said policy determination apparatus determines whether said second set of decisions is logically included by said predetermined accession permission condition.