Subject matching for distributed access control scenarios

At least one non-transitory machine-readable storage medium, comprising a plurality of instructions adapted for determining an access control policy, wherein the instructions, responsive to being executed with processor circuitry of a machine, cause the processing circuitry to:

• receive a request from a subject to perform an operation with an object, the subject operating in accordance with a first type of access policy, and the object operating in accordance with a second type of access policy;
• evaluate the first type of access policy of the subject to determine a first access scope with regard to performing the requested operation;
• evaluate the second type of access policy of the object to determine a second access scope with regard to performing the requested operation;
• identify an access control object that provides a mapping between the first access scope and the second access scope for the requested operation, wherein to identify the access control object includes matching of the requested operation to a security level defined in the access control object, based on an exit-point scope of the access control object to perform the requested operation;
• cause the access control object to map the first access scope and the second access scope for the requested operation, wherein to map the first access scope and the second access scope includes aligning a scoping context for the first access scope and the second access scope;
• and
• provide access from the subject to the object based on a security level determined from the mapping between the first access scope and the second access scope provided by the access control object.

A method of determining an access control policy, the method comprising:

• receiving a request from a subject to perform an operation with an object, the subject operating in accordance with a first type of access policy, and the object operating in accordance with a second type of access policy;
• evaluating the first type of access policy of the subject to determine a first access scope with regard to performing the requested operation;
• evaluating the second type of access policy of the object to determine a second access scope with regard to performing the requested operation;
• identifying an access control object that provides a mapping between the first access scope and the second access scope for the requested operation, wherein identifying the access control object includes matching the requested operation to a security level defined in the access control object, based on an exit-point scope of the access control object to perform the requested operation;
• causing the access control object to map the first access scope and the second access scope for the requested operation, wherein to map the first access scope and the second access scope includes aligning a scoping context for the first access scope and the second access scope;
• and
• providing access from the subject to the object based on a security level determined from the mapping between the first access scope and the second access scope provided by the access control object.