Back to results
US 10,311,248 B1Granted
Managing delegated access permissions
AssigneeIntuit Inc.
InventorsNadeem Mohammed Yusuf Ilkal, Andrew Ernest Goldfinch, Yi Zhang, Almira Hortensia Niciu-Chiuaru
Life of this patent
Estimating the term…
Abstract
A method for permission management may include creating a relationship between a client and a firm, receiving, in response to creating the relationship, an assignment of a first role to the firm, receiving, in response to receiving the assignment of the first role, an assignment of a second role to an agent of the firm, and generating, for the agent, a runtime token including token permissions based on the first role and the second role.
Claims20
A method for permission management comprising:
- partitioning, by a server computer, a relationship between a client and a first agent of a first firm into a first relationship between the client and the first firm and a second relationship between the first firm and the first agent, by:
- receiving an assignment of a first role to the first firm with respect to the client, wherein the first role comprises a first set of permissions granting access to a first portion of data in a business management application (BMA),
- receiving, in response to receiving the assignment of the first role, an assignment of a second role to the first agent of the first firm,
- wherein the second role comprises a second set of permissions granting access to a second portion of data in the BMA, and
- wherein the permissions to the second portion are less than the permissions to the first portion, and
- generating, for the first agent, a first runtime token for the BMA,
- wherein the first runtime token comprises a third set of permissions comprising an intersection of the first set of permissions and the second set of permissions,
- wherein the intersection is different than the first set of permissions and the second set of permissions, and
- wherein the third set of permissions granting access to a third portion of data in the BMA comprises an intersection of the first portion and the second portion,
- wherein the first relationship and the second relationship are independent of each other;
- and
- granting, responsive to receiving the first runtime token, access to the third portion of data.
9 more elements
A system for permission management comprising:
- a role manager configured to:
- partition, by a server computer, a relationship between a client and a first agent of a first firm into a first relationship between the client and the first firm and a second relationship between the first firm and the first agent, by:
- receiving an assignment of a first role to the first firm with respect to the client, wherein the first role comprises a first set of permissions granting access to a first portion of data in a business management application (BMA);
- and
- receiving, in response to receiving the assignment of the first role, an assignment of a second role to the first agent of the first firm,
- wherein the second role comprises a second set of permissions granting access to a second portion of data in the BMA, and
- wherein the permissions to the second portion are less than the permissions to the first portion,
- wherein the first relationship and the second relationship are independent of each other;
- a runtime manager configured to:
- generate, for the first agent, a first runtime token for the BMA,
- wherein the first runtime token comprises a third set of permissions comprising an intersection of the first set of permissions and the second set of permissions,
- wherein the intersection is different than the first set of permissions and the second set of permissions, and
- wherein the third set of permissions granting access to a third portion of data in the BMA comprises an intersection of the first portion and the second portion;
- and
- grant, responsive to receiving the first runtime token, access to the third portion of data;
- and
- a repository, configured to store at least the first role and the second role.
14 more elements
A non-transitory computer readable medium comprising instructions that, when executed by a computer processor, perform a method for permission management comprising:
- partitioning, by a server computer, a relationship between a client and a first agent of a first firm into a first relationship between the client and the first firm and a second relationship between the first firm and the first agent, by:
- receiving an assignment of a first role to the first firm with respect to the client, wherein the first role comprises a first set of permissions granting access to a first portion of data in a business management application (BMA),
- receiving, in response to receiving the assignment of the first role, an assignment of a second role to the first agent of the first firm,
- wherein the second role comprises a second set of permissions granting access to a second portion of data in the BMA, and
- wherein the permissions to the second portion are less than the permissions to the first portion, and
- generating, for the first agent, a first runtime token for the BMA,
- wherein the first runtime token comprises a third set of permissions comprising an intersection of the first set of permissions and the second set of permissions,
- wherein the intersection is different than the first set of permissions and the second set of permissions, and
- wherein the third set of permissions granting access to a third portion of data in the BMA comprises an intersection of the first portion and the second portion,
- wherein the first relationship and the second relationship are independent of each other;
- and
- granting, responsive to receiving the first runtime token, access to the third portion of data.
9 more elements
Dependencies are inferred from the claim text.