Patent ID: 7650644

Claim:
A computer-readable medium included in a storage device and having embodied thereon a computer program configured to determine whether a user is permitted to access requested attributes of a business object when executing a software application of an enterprise information technology system, the medium storing one or more code segments configured to: use a permission object to determine whether a user associated with an entry in user information is permitted to access requested attributes of a data object associated with a data object type, wherein: the entry in the user information associates the user with a user affiliation, the permission object identifies: a user affiliation to which the permission object applies, a data object type to which the permission object applies such that the data object type identified by the permission object is associated with multiple attributes and each data object having the data object type identified by the permission object is associated with the multiple attributes, a permission attribute identifying at least one of the multiple attributes, a permission value for the permission attribute, and an attribute access group having a subset of attributes of the multiple attributes, the subset of attributes being fewer than all of the multiple attributes, wherein the permission object is configured to control access with the permission attribute when the permission attribute is included in the subset of attributes and to control access with the permission attribute when the permission attribute is not included in the subset of attributes, wherein upon determination that: (1) the user affiliation that is associated with the user is the same user affiliation as the user affiliation to which the permission object applies, (2) the data object type of the data object is the same as the data object type to which the permission object applies, (3) a value of the permission attribute associated with the data object is consistent with the permission value for the permission attribute, and (4) at least one of the requested attributes of the data object corresponds to an attribute included in the attribute access group of the permission object, the user is permitted to access any of the requested attributes indicated by the subset of attributes and not permitted to access any of the requested attributes not indicated by the subset of attributes, and wherein otherwise the user is denied access to all the requested attributes.