Patent ID: 8359467

Claim:
An access control system stored in a memory and implemented on at least one computing platform, for controlling access to file system objects stored in a digital file system store, the system comprising: a first compartment rule type for granting a first permission to an entity, associated with a respective compartment to which the rule is applied, to lookup a directory object in a directory path where the directory object is located and list the contents of the directory object, wherein lookup comprises traversing the directory path from a root directory to the directory object to identify the directory object in the file system store; and a second compartment rule type for granting a second permission to the entity, associated with a respective compartment to which the rule is applied, to lookup a directory object in a directory path where the directory object is located and not to list contents of the directory object, wherein lookup comprises traversing the directory path from a root directory to the directory object to identify the directory object in the file system store, and wherein the system is arranged such that, if the second rule type is applied to a first directory object and the first rule type is applied to a second directory object underneath the first directory object, then said entity, which is associated with a compartment with which the rules are applied, has permissions to lookup both said directories and list the contents of only the second directory such that the contents of the first directory not located in the directory path are invisible to the entity.