Data access rules in a database layer

A method comprising:

• receiving, at a database layer of a database in a system, a query from an application running on a client device to access a dataset from at least one database, the query associated with a user;
• identifying, by the database layer of the database, at least one data access rule that is applicable to the dataset, the at least one data access rule specifying at least a first authorized access group and at least a second authorized access group;
• identifying, by the database layer of the database, an authorized access group associated with the user;
• comparing, by the database layer of the database, the authorized access group associated with the user with each of the at least first authorized access group and the at least second authorized access group specified in the at least one data access rule;
• determining, by the database layer of the database, that the authorized access group associated with the user matches the at least first authorized access group;
• determining, by the database layer of the database, that the at least one data access rule has an associated reference date;
• identifying;
• by the database layer of the database, a time limit specified by the at least one access rule for the first authorized access group, the time limit measured from the reference date and after which access to a portion of the requested dataset is restricted to the first authorized access group;
• determining, by the database layer of the database, whether the query to access the dataset is received within the time limit specified for the first authorized access group;
• based on determining that the query to access the dataset is received within the time limit specified for the first authorized access group, assembling the requested dataset of the query and transmitting the requested dataset to the application;
• and
• based on determining that the query to access the dataset is received after the e limit specified for the first authorized access group, assembling, by the database layer of the database, a modified dataset by filtering out data from the requested dataset of the query that does not comply with the at least one data access rule based on the time limit specified for the first authorized access group, and transmitting the modified dataset to the application.

A non-transitory machine-readable storage medium storing instructions which, when executed by one or more hardware processors of a machine, cause the machine to perform operations comprising:

• receiving, at a database layer of a database, a query from an application running on a client device to access a dataset from at least one database, the query associated with a user;
• identifying, by the database layer of the database, at least one data access rule that is applicable to the dataset, the at least one data access rule specifying at least a first authorized access group and at least a second authorized access group;
• identifying, by the database layer of the database, an authorized access group associated with the user;
• comparing, by the database layer of the database the authorized access group associated with the user with each of the at least first authorized access group and the at least second authorized access group specified in the at least one data access rule;
• determining, by the database layer of the database, that the authorized access group associated with the user matches the at least first authorized access group;
• determining, by the database layer of the database, that the at least one data access rule has an associated reference date;
• identifying, by the database layer of the database, a time limit specified by the at least one access rule for the first authorized access group, the time limit measured from the reference date and, after which access to a portion of the requested dataset is restricted to the first authorized access group;
• determining by the database layer of the database, whether the query to access the dataset is received within the time limit specified for the first authorized access group;
• based on determining that the query to access the dataset is received within the time limit specified for the first authorized access group, assembling the requested dataset of the query and transmitting the requested dataset to the application;
• and
• based on determining that the query to access the dataset is received after the time limit specified for the first authorized access group,
• assembling, by the database layer of the database, a modified dataset by filtering out data from the requested dataset of the query that does not comply with the at least one data access rule based on the time limit specified for the first authorized access group, and transmitting the modified dataset to the application.