| 摘要 |
A system and method for selectively granting access to a target object. In one embodiment, the system includes an object data store, an access control instruction data store, an action data store, a context, and an access determination engine. The object data store includes a plurality of hierarchically structured target objects and a plurality of hierarchically structured actor objects. The access control instruction data store includes a plurality of hierarchically structured access control instructions. The action data store comprising a plurality action objects. The context includes an actor attribute, an action attribute, and a target attribute. The access determination engine configured to selectively grant access to the target object based on a first set of access control instructions having attributes that match the context and a second set of access control instructions having attributes that are hierarchically broader than the attributes of the context.
|
