Management of actions and permissions to applications in an enterprise network

An actions and permissions ownership (APO) device for managing access to data of an enterprise for a plurality of roles as controlled by a plurality of applications of the enterprise, each application accessing the data through a respective plurality of actions, each action having a respective plurality of permission levels with which to restrict the data access by the action, the APO device comprising:

• a processing unit;
• a non-transitory computer readable medium;
• logic to receive a request from an owner of a first role of the plurality of roles to modify the data access for the first role as controlled by a first application of the plurality of applications through a first action of the respective plurality of actions of the first application, wherein the request is further to modify the data access for the first role by the first action to a first permission level of the respective plurality of permission levels of the first action;
• logic to, in response to receiving the request, look up an owner of the first application in a non-transitory electronic APO database;
• logic to request an approval from the first application owner to modify the data access for the first role by the first action to the first permission level;
• logic to receive the approval from the first application owner to modify the data access for the first role;
• logic to, in response to receiving the approval, update a non-transitory electronic role database to modify the first role to reflect the request;
• logic to, in response to receiving the rejection, notify the first role owner of the rejection;
• logic to receive a request from the first application owner to register a second action to the respective plurality of actions of the first application along with a respective plurality of permission levels of the second action in the APO database;
• and
• logic to, in response to receiving the request to register the second action, update the APO database to register the second action and the respective plurality of permission levels of the second action to the first application in the APO database.

A non-transitory computer-readable medium (CRM) storing instructions that, when executed on a computer processor, cause the processor to carry out a process of actions and permissions ownership (APO) for managing access to data of an enterprise for a plurality of roles as controlled by a plurality of applications of the enterprise, each application accessing the data through a respective plurality of actions, each action having a respective plurality of permission levels with which to restrict the data access by the action, the process comprising:

• receiving a request from an owner of a first role of the plurality of roles to modify the data access for the first role as controlled by a first application of the plurality of applications through a first action of the respective plurality of actions of the first application, wherein the request is further to modify the data access for the first role by the first action to a first permission level of the respective plurality of permission levels of the first action;
• in response to receiving the request, looking up an owner of the first application in a non-transitory electronic APO database;
• requesting an approval from the first application owner to modify the data access for the first role by the first action to the first permission level;
• receiving the approval from the first application owner to modify the data access for the first role;
• in response to receiving the approval, updating a non-transitory electronic role database to modify the first role to reflect the request;
• in response to receiving the rejection, notifying the first role owner of the rejection;
• receiving a request from the first application owner to register a second action to the respective plurality of actions of the first application along with a respective plurality of permission levels of the second action in the APO database;
• and
• in response to receiving the request to register the second action, updating the APO database to register the second action and the respective plurality of permission levels of the second action to the first application in the APO database.