Patent ID: 7392383

Claim:
A computer implemented method in a data processing system for managing access to resources, the method comprising: responsive to matching an entry in an access control list of a specific resource with credentials of a process, granting a security identifier given by the access control list to the process, wherein the security identifier has no meaning outside of being used to make an access decision for the specific resource, wherein granting the security identifier further comprises: adding the security identifier to the credentials of the process to form an object access identifier, wherein the object access identifier is granted based on a path of execution; limiting a scope of the security identifier to an application space, wherein access rights associated with the security identifier are limited to a specific application, and wherein propagation of access rights is prevented by specifying the access rights are limited to the specific application; and responsive to granting the security identifier to the process, identifying the security identifier as an unavailable security identifier that is no longer available to be granted to other processes, wherein the security identifier is not reused; and responsive to the process requesting access to the specific resource, generating the access decision based on the security identifier.