Patent ID: 7926086

Claim:
A machine readable non-transitory medium, comprising instructions for causing one or more processors to: execute a first application from a first bundle of applications to obtain a first application instance in a first execution context, wherein the first application instance comprises a first protected resource in a shareable interface object (SIO), wherein the first execution context is isolated by a firewall from a second execution context, wherein the first execution context is associated with a first protection domain, and wherein the first protection domain specifies the first bundle of applications a first set of instructions, when executed giving rise to the first application instance, is packaged within a first application module; receive a request from a second application instance executing in the second execution context-to access the first protected resource, wherein the second application instance is obtained by executing a second application from a second bundle of applications, wherein the second execution context is associated with a second protection domain, wherein the second protection domain specifies a second bundle of applications subject to a first domain security policy, wherein the first domain security policy comprises a first list of protection domains, and wherein the first domain security policy permits an application from the second bundle of applications to access a protected resource of another protection domain when the another protection domain is specified in the first list of protection domains in a shareable interface object (SIO) in the first application instance, make a first determination, based on the request and first domain security policy, that the first protection domain is specified in the first list of protection domains based on the first determination: make a second determination, based on the second application and a declarative security policy associated with the first application that the second application is authorized to access the protected resource; and based on the first determination and the second determination: grant the second application access to the first protected resource.