Patent ID: 7568217

Claim:
A method for using a role based access control system on a network, the method comprising the computer-implemented steps of: detecting that a user has initiated, during a network session, an operation to be performed requiring a resource provided on the network; identifying a condition specified from the user initiating the operation; wherein the condition is that the user must be assigned a particular conditional role, which is mutually exclusive with at least one other role already assigned to the user, to perform the operation requiring the resource; determining, based on the condition, whether the particular conditional role is to be assigned to the user during the network session, the particular conditional role defining a set of one or more privileges for a class of users on the network, the set of one or more privileges comprising a privilege required to perform the operation; and in the same network session, dynamically assigning to the user in response to the detecting and determining, the particular conditional role from a plurality of otherwise mutually exclusive roles that the user is allowed to mutually occupy if the condition is satisfied.