Enhanced permissions management

A computer-implemented method, comprising:

• under the control of one or more computer systems configured with executable instructions,
• associating a first user account and a second user account with a user group, wherein the first user account, the second user account, and the user group are each represented by respective nodes stored in a graph data structure;
• generating a first directed edge in the graph data structure connecting the node of the first user account and the node of the user group, the first directed edge corresponding to the association of the first user account with the user group;
• generating a second directed edge in the graph data structure connecting the node of the second user account and the node of the user group, the second directed edge corresponding to the association of the second user account with the user group;
• associating a first demographic data set and a second demographic data set with a demographic data group, wherein the first demographic data set, the second demographic data set, and the demographic data group are each represented by respective nodes stored in the graph data structure;
• generating a third directed edge in the graph data structure connecting the node of the first demographic data set and the node of the demographic data group, the third directed edge corresponding to the association of the first demographic data set with the demographic data group;
• generating a fourth directed edge in the graph data structure connecting the node of the second demographic data set and the node of the demographic data group, the fourth directed edge corresponding to the association of the second demographic data set with the demographic data group;
• generating a fifth directed edge in the graph data structure connecting the node of the user group and the node of the demographic data group, the fifth directed edge corresponding to an access permission associated with the first and second demographic data set, and wherein the node of the user group, the node of the demographic data group, and the fifth edge comprise a bipartite graph;
• receiving, at the computer system from a user associated with the first user account, a request to access the first demographic data set;
• determining a path between the first user account and the first demographic data set along respective edges, the path including a first segment starting at the first user account and moving between respective bipartite graphs in a first direction, and a second segment starting at the first demographic data set and moving between respective bipartite graphs in a second direction, the first direction being opposite the second direction, wherein the first segment and the second segment are determined in parallel;
• determining starting points and end points of the respective segments forming the path, wherein segment access permissions of the respective segments are directional, and one or more of the respective groups restrict a permission direction;
• determining that the access is allowed, based at least in part on the permission corresponding to the fifth directed edge as determined by the path;
• and
• providing the first demographic data set to the user.