# US 10,311,248 B1 · Managing delegated access permissions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,311,248 B1
- Document ID: US10311248B1
- Status: Granted
- Kind: B1
- Application number: 15/418,639
- Filed: 2017-01-27
- Granted: 2019-06-04
- Earliest claimed: 2017-01-27
- Assignees: Intuit Inc.
- Applicants: Nadeem Mohammed Yusuf Ilkal; Andrew Ernest Goldfinch; Yi Zhang; Almira Hortensia Niciu-Chiuaru
- Inventors: Nadeem Mohammed Yusuf Ilkal; Andrew Ernest Goldfinch; Yi Zhang; Almira Hortensia Niciu-Chiuaru
- Web page: https://patentgrep.com/patent/US10311248B1

## CPC

- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06Q 40/12: Accounting
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 63/105: {Multiple levels of security}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for permission management may include creating a relationship between a client and a firm, receiving, in response to creating the relationship, an assignment of a first role to the firm, receiving, in response to receiving the assignment of the first role, an assignment of a second role to an agent of the firm, and generating, for the agent, a runtime token including token permissions based on the first role and the second role.

## Claims

### Claim 1

A method for permission management comprising:
partitioning, by a server computer, a relationship between a client and a first agent of a first firm into a first relationship between the client and the first firm and a second relationship between the first firm and the first agent, by:
receiving an assignment of a first role to the first firm with respect to the client, wherein the first role comprises a first set of permissions granting access to a first portion of data in a business management application (BMA),
receiving, in response to receiving the assignment of the first role, an assignment of a second role to the first agent of the first firm,
wherein the second role comprises a second set of permissions granting access to a second portion of data in the BMA, and
wherein the permissions to the second portion are less than the permissions to the first portion, and
generating, for the first agent, a first runtime token for the BMA,
wherein the first runtime token comprises a third set of permissions comprising an intersection of the first set of permissions and the second set of permissions,
wherein the intersection is different than the first set of permissions and the second set of permissions, and
wherein the third set of permissions granting access to a third portion of data in the BMA comprises an intersection of the first portion and the second portion,
wherein the first relationship and the second relationship are independent of each other; and
granting, responsive to receiving the first runtime token, access to the third portion of data.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
creating a third relationship between the client and a second firm;
receiving, in response to creating the third relationship, an assignment of a third role to the second firm, the third role comprising a fourth set of permissions, wherein each permission in the fourth set of permissions permits access to the third portion of data in the BMA;
receiving, in response to receiving the assignment of the third firm role, an assignment of a fourth role to the first agent, the fourth role comprising a fifth set of permissions, wherein each permission in the fifth set of permissions permits access to the third portion of data in the BMA, wherein the first agent is employed by the second firm; and
adding, to the first runtime token, a sixth set of permissions comprising a second intersection of the fourth set of permissions and the fifth set of permissions.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
receiving a notification of the termination of the first role; and
removing, from the first runtime token and in response to receiving the notification, the third set of permissions.

### Claim 4 (depends on 2)

The method of claim 2, further comprising:
receiving a notification of the termination of the second role; and
removing, from the first runtime token and in response to receiving the notification, the third set of permissions.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
creating a third relationship between the client and a second agent;
receiving, in response to creating the third relationship, an assignment of a third role to the second agent; and
generating, for the second agent, a second runtime token comprising a set of token permissions based on the third role.

### Claim 6 (depends on 1)

The method of claim 1, wherein the first relationship is created in response to a set of messages exchanged between the client and the first firm.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
receiving, in response to receiving the assignment of the first role, an assignment of a third role to a second agent of the first firm, wherein the second role and the third role are different, the third role comprising a fourth set of permissions granting access to the third portion of data in the BMA; and
generating, for the second agent, a second runtime token for the BMA, the second runtime token comprising a fifth set of permissions comprising an intersection of the first set of permissions and the fourth set of permissions, the intersection different than the first set of permissions and the fourth set of permissions, and the fourth set of permissions granting access to a fourth portion of data in the BMA comprising an intersection of the first portion and the fourth portion.

### Claim 8 (depends on 1)

The method of claim 1 further comprising:
changing, in response to a command received from the first firm, the second role between the first agent and the first firm without changing the first role between the first firm and the client, wherein changing the second role changes the second set of permissions and the third set of permissions without changing the first set of permissions, and wherein the first role is received from the client.

### Claim 9 (depends on 8)

The method of claim 8 wherein changing the second role comprises removing the first role, wherein the third set of permissions are removed without changing the first set of permissions.

### Claim 10 (depends on 8)

The method of claim 8 wherein changing the second role comprises adding new permissions to the second set of permissions, wherein the third set of permissions are altered without changing the first set of permissions.

### Claim 11

A system for permission management comprising:
a role manager configured to:
partition, by a server computer, a relationship between a client and a first agent of a first firm into a first relationship between the client and the first firm and a second relationship between the first firm and the first agent, by:
receiving an assignment of a first role to the first firm with respect to the client, wherein the first role comprises a first set of permissions granting access to a first portion of data in a business management application (BMA); and
receiving, in response to receiving the assignment of the first role, an assignment of a second role to the first agent of the first firm,
wherein the second role comprises a second set of permissions granting access to a second portion of data in the BMA, and
wherein the permissions to the second portion are less than the permissions to the first portion,
wherein the first relationship and the second relationship are independent of each other;
a runtime manager configured to:
generate, for the first agent, a first runtime token for the BMA,
wherein the first runtime token comprises a third set of permissions comprising an intersection of the first set of permissions and the second set of permissions,
wherein the intersection is different than the first set of permissions and the second set of permissions, and
wherein the third set of permissions granting access to a third portion of data in the BMA comprises an intersection of the first portion and the second portion; and
grant, responsive to receiving the first runtime token, access to the third portion of data; and
a repository, configured to store at least the first role and the second role.

### Claim 12 (depends on 11)

The system of claim 11,
wherein the role manager is further configured to:
create a third relationship between the client and a second firm;
receive, in response to creating the third relationship, an assignment of a third role to the second firm, the third role comprising a fourth set of permissions, wherein each permission in the fourth set of permissions permits access to the third portion of data in the BMA; and
receive, in response to receiving the assignment of the third firm role, an assignment of a fourth role to the first agent, the fourth role comprising a fifth set of permissions, wherein each permission in the fifth set of permissions permits access to the third portion of data in the BMA, wherein the first agent is employed by the second firm, and
wherein the runtime manager is further configured to:
add, to the first runtime token, a sixth set of permissions comprising a second intersection of the fourth set of permissions and the fifth set of permissions.

### Claim 13 (depends on 12)

The system of claim 12,
wherein the role manager is further configured to:
receive a notification of the termination of the first role, and
wherein the runtime manager is further configured to:
remove, from the first runtime token and in response to receiving the notification, the third set of permissions.

### Claim 14 (depends on 12)

The system of claim 12,
wherein the role manager is further configured to:
receive a notification of the termination of the second role, and
wherein the runtime manager is further configured to:
remove, from the first runtime token and in response to receiving the notification, the third set of permissions.

### Claim 15 (depends on 11)

The system of claim 11, wherein the first relationship is created in response to a set of messages exchanged between the client and the first firm.

### Claim 16

A non-transitory computer readable medium comprising instructions that, when executed by a computer processor, perform a method for permission management comprising:
partitioning, by a server computer, a relationship between a client and a first agent of a first firm into a first relationship between the client and the first firm and a second relationship between the first firm and the first agent, by:
receiving an assignment of a first role to the first firm with respect to the client, wherein the first role comprises a first set of permissions granting access to a first portion of data in a business management application (BMA),
receiving, in response to receiving the assignment of the first role, an assignment of a second role to the first agent of the first firm,
wherein the second role comprises a second set of permissions granting access to a second portion of data in the BMA, and
wherein the permissions to the second portion are less than the permissions to the first portion, and
generating, for the first agent, a first runtime token for the BMA,
wherein the first runtime token comprises a third set of permissions comprising an intersection of the first set of permissions and the second set of permissions,
wherein the intersection is different than the first set of permissions and the second set of permissions, and
wherein the third set of permissions granting access to a third portion of data in the BMA comprises an intersection of the first portion and the second portion,
wherein the first relationship and the second relationship are independent of each other; and
granting, responsive to receiving the first runtime token, access to the third portion of data.

### Claim 17 (depends on 16)

The non-transitory computer readable medium of claim 16, the method further comprising:
creating a third relationship between the client and a second firm;
receiving, in response to creating the third relationship, an assignment of a third role to the second firm, the third role comprising a fourth set of permissions, wherein each permission in the fourth set of permissions permits access to the third portion of data in the BMA;
receiving, in response to receiving the assignment of the third firm role, an assignment of a fourth role to the first agent, the fourth role comprising a fifth set of permissions, wherein each permission in the fifth set of permissions permits access to the third portion of data in the BMA, wherein the first agent is employed by the second firm; and
adding, to the first runtime token, a sixth set of permissions comprising a second intersection of the fourth set of permissions and the fifth set of permissions.

### Claim 18 (depends on 17)

The non-transitory computer readable medium of claim 17, the method further comprising:
receiving a notification of the termination of the first role; and
removing, from the first runtime token and in response to receiving the notification, the third set of permissions.

### Claim 19 (depends on 16)

The non-transitory computer readable medium of claim 16, the method further comprising:
creating a third relationship between the client and a second agent;
receiving, in response to creating the third relationship, an assignment of a third role to the second agent; and
generating, for the second agent, a second runtime token comprising a set of token permissions based on the third role.

### Claim 20 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the first relationship is created in response to a set of messages exchanged between the client and the first firm.