Patent ID: 7644432

Claim:
A computer-implemented method for policy inheritance, comprising: providing a plurality of servers, wherein one or more of the plurality of servers execute on at least one server computer in an enterprise and wherein the at least one server computer includes a computer readable medium and processor operating thereon; defining a plurality of groups, organized in a group hierarchy, including a first group wherein the first group includes at least one user, and a second group nested within the first group; organizing a plurality of resources in a resource hierarchy including at least one parent resource and at least one child resource; defining a plurality of policies, including a first policy, wherein the policies are used to control access to at least one resource of the plurality of resources and wherein each policy is associated with at least one group of the plurality of groups; provisioning the plurality of policies from an administrative server to at least one security control manager (SCM) on the at least one server computer wherein each SCM executes on a different server computer in the enterprise; sending a subset of the plurality of policies from the SCM to a plurality of security service modules (SSMs) wherein the SCM sends each policy to a relevant SSM executing on the server computer with the SCM; wherein the plurality of SSMs are distributed to a plurality of systems, including applications and servers, on the at least one server computer in the enterprise and wherein each SSM is embedded with and uses the policies to control access to resources in one of the plurality of systems; wherein each policy definition indicates the at least one resource and the at least one group associated with the policy and wherein each policy definition also indicates an action which the at least one group may perform on the at least one resource; wherein the first policy controls access to a first parent resource and wherein the first policy is associated with the first group; inheriting the first policy by the second group; inheriting each policy associated with the at least one parent resource by the at least one child resource; and assigning policies to the at least one child resource, wherein the assigned policies override inherited policies from the at least one parent resource, and wherein the assigned policies are then inherited by child resources of the at least one child resource.