Patent ID: 8650623

Claim:
A method for access control, the method comprising: implementing the method for access control using a computing system within an organization by: using a computer processor, determining a total risk tolerance level for the organization based on a cost to the organization of unauthorized disclosure of objects comprising information maintained by the organization; expressing the total risk tolerance level as a pre-determined quantity of total risk units; allocating a portion of the pre-determined quantity of total risk units to each one of a plurality of subjects in an organization, each subject comprising an employee of the organization and each allocating portion comprising a risk quota; using a computer processor, receiving a request from one of the plurality of subjects for access to an object; using a computer processor, quantifying a risk level associated with the requested object access, the risk level comprising an expected value of loss incurred through an unauthorized disclosure of the object by the requesting subject; allowing the requesting subject independent of approval from the organization to determine an allocation of the risk quota allocated to the requesting subject to be used in determining whether or not to grant the received request; granting the requested object access based on a comparison of the quantified risk level to the requesting subject determined allocation of risk quota.