Patent ID: 8533846

Claim:
A method for dynamically associating, by a server, access rights with a resource, the method comprising the steps of: (a) receiving, by a server, a request for a resource from a client; (b) transmitting, by a policy engine executing on the server, a collection agent to the client in response to receiving the request; (c) receiving, by the policy engine from the collection agent executing on the client, client information; (d) applying, by a first component of the policy engine, policies to the client information to generate a dataset comprising a plurality of identifiers, each of the plurality of identifiers identifying a respective condition satisfied by the client information; (e) transmitting, by the first component of the policy engine to a second component of the policy engine, the dataset comprising the plurality of identifiers; (f) applying, by the second component of the policy engine, policies to the dataset to identify a plurality of levels of access rights associated with the resource; (g) requesting, by the server from the second component of the policy engine, the plurality of levels of access rights to associate with the resource; (h) signing, by the server, the resource with the plurality of levels of access rights via an extensible rights markup language; (i) transmitting, by the server, the resource signed with the plurality of levels of access rights to the client; (j) making, by an application program responsive to receiving from the server the signed resource, an access control decision using the plurality of levels of access rights, the application program executing on the client; and (k) providing, by the application program, restricted access to the resource responsive to the access control decision.