Patent ID: 8181243

Claim:
A non-transitory computer readable storage medium storing a set of instructions executed by one or more processors to perform steps comprising: providing a plurality of roles, organized in a role hierarchy, wherein the role hierarchy includes parent roles and child roles; assigning one or more roles of the plurality of roles to at least one user; defining a role context for a set of functionality within a computer system, wherein the role context identifies the set of functionality that requires privileged access, and wherein the role context is part of a role context hierarchy which includes parent role contexts and child role contexts; activating the at least one of the plurality of roles within the role context by associating the at least one of the plurality of roles with a set of permissions and a role activation operator, wherein the role context inherits one or more permissions from a plurality of parent role contexts in the role context hierarchy; receiving a request to resolve an aggregate permission for said at least one user; determining which of the one or more roles assigned to the at least one user are also activated within the role context; retrieving those roles determined to be assigned to the at least one user and activated within the role context; for each of the plurality of roles assigned to the at least one user, determining the aggregate permission for that role by traversing the role context hierarchy from the role context to the plurality of parent role contexts until a definitive permission is determined, which can include a grant or an override deny, wherein each aggregate permission is a locally specified permission within a closest role context to the role context in the role context hierarchy, wherein for each of the plurality of roles a role activation operator determines how that role is evaluated.