Patent ID: 7120698

Claim:
A system for selectively granting access to a target object, comprising: an object data store that includes a plurality of hierarchically structured target objects and a plurality of hierarchically structured actor objects; an action data store that includes a plurality of action objects; an access control instruction data store comprising a plurality of hierarchically structured access control instructions; a context comprising an actor attribute, an action attribute, and a target attribute; and an access determination engine configured to selectively grant access to the target object based on a first set of access control instructions having attributes that match the context and a second set of access control instructions having attributes that are hierarchically broader than the attributes of the context, wherein the access determination engine determines whether the first set of access control instructions and the second set of access control instructions are relevant, and responsive to determining that the first set of access control instructions and the second set of access control instructions are relevant then determining whether any of the first set of access control instructions conflict with any of the second set of access control instructions and, when conflicting instructions are found, resolving access control instruction conflicts by determining whether access control instruction access attribute values for the first and second set of access control instructions conflict with either each other or a default access value and responsive to determining that any access control instruction value denies access to the target object including the default access value, denying access to the target object.