Patent ID: 8850528

Claim:
A method of authorizing a subject to perform an action on an object in a cloud computing environment having a plurality of computing nodes, the method comprising: receiving a request by a user for performing an action in the cloud computing system the request comprising a first key-value pair identifying the action and a second key-value pair identifying the object upon which the action is to be performed; determining, from a plurality of permissions, whether an object permission exists having an identifier that matches the value of the key-value pair in the request identifying the object upon which the action is to be performed, each of the plurality of permissions comprising at least one object permission key-value pair defining a delegation path of permission for the object; determining, from the plurality of permissions, whether a user permission exists for the user making the request to act upon the object, each of the plurality of permissions comprising at least one user permission key-value pair defining a delegation path of permission for the user; authorizing the request based on the object permission and user permission for the action on the object in response to determining that both the object permission and the user permission exist; and denying the request in response to determining that at least one of the object permission or the user permission does not exist.