Patent ID: 7685644

Claim:
A method of managing user access to data, the method being implemented using one or more data processors and comprising: detecting, by at least one of the data processors, that a user seeks access to a data portion within a data hierarchy that belongs to two or more specified categories, each category requiring different authorization in order to access the data portion, at least one of the categories pertaining to a first sub-portion of the data portion and at least one of the categories pertaining to a second sub-portion of the data portion, the first sub-portion differing in scope to the second sub-portion, wherein access to the data portion requires access to both the first sub-portion and the second sub-portion; associating, by at least one of the data processors, the user with a role; evaluating, by at least one of the data processors, two or more authorizations based on the role associated with the user, each authorization having an authorization segment corresponding to at least one of the specified categories; permitting, by at least one of the data processors, the sought access to the data portion if, for each specified category, there is at least one corresponding authorization segment, wherein each specified category identifies the respective data sub-portion to which access is sought; and limiting, by at least one of the data processors, access to other sub-portions of the data hierarchy by hiding information relating to the other sub-portions of the data hierarchy, when the user navigates through nodes of the data hierarchy.