Patent ID: 8150820

Claim:
A system comprising: a database including: user records representative of system users; group records defining groups; group assignment records associating users to groups; visible user/group records identifying users and groups viewable by users and groups; policy records defining content access policies assignable to items of electronic content, wherein a content access policy identifies one or more permitted and restricted user actions with regard to an item of electronic content when a user accesses the item of electronic content associated with the content access policy; and user/group policy records associating a policy record to a user or group record; and a user/group policy assignment module executable by at least one processor of the system to: receive input in a policy user interface to modify policy records; and receive input in the policy user interface to modify user/group policy records; a visible user/group module executable by the at least one processor of the system to: receive, from a requestor, a request for a listing of users and groups viewable by a user with regard to an item of content; retrieve a listing of users and groups viewable by the user from the database as defined by at least one policy record associated with the requestor and the item of content; and return the retrieved listing to the requestor, wherein the visible user/group module in retrieving only a listing of users and groups viewable by the user thereby limits an ability of the user/group assignment module to receive input modifying user/group policy records that associate a policy record to a user or group record; and a content item policy fulfillment module executable by the at least one processor of the system to: receive a policy request from an application attempting to operate using a content item, the policy request including identity data of a user of the application and data identifying a policy assigned to the content item; determine if the user of the application is associated with the identified policy; when the user is associated with the policy, retrieve a policy record as a function of the data identifying the policy and sending the policy record to the requesting application.