Patent ID: 8590052

Claim:
A method comprising: receiving of a data request by a data storage cloud service of a cloud storage system, wherein said data request requests access to a data artifact stored by the cloud storage system within a cloud computing environment; determining of a response to the data request by the data storage cloud service, wherein said determination indicates at least one of allowing access and denying access to the data artifact; detecting of the data storage cloud service's receipt of the data request by an access manager cloud service; interrupting of the data storage cloud service's handling of the data request prior to an execution of the determined response by the access manager cloud service; obtaining of a copy of the data request and the data storage cloud service's response by the access manager cloud service; evaluating of contents of the copy of the data request by the access manager cloud service with respect to discretionary access controls defined for the data artifact, wherein said discretionary access controls are configured by an entity associated with the data artifact; determining of response from said evaluation of the data request copy by the access manager cloud service, wherein said determination indicates at least one of allowing access and denying access to the data artifact; comparing of the response determined by the data storage cloud service with the response internally determined by the access manager cloud service; if said comparison indicates disagreement between the responses of the data storage cloud service and the access manager cloud service, overriding of the data storage cloud service's response by the access manager cloud service, wherein the response determined by the access manager cloud service is given precedence over the response determined by the data storage cloud service; and if said comparison indicates agreement between the responses of the data storage cloud service and the access manager cloud service, releasing of the interruption to the data storage cloud service's handling of the data request by the access manager cloud service, wherein the data storage cloud service is allowed to complete fulfillment of the data request.