Data management systems and methods

A method for managing access to a governed object performed by a data management system comprising at least one processor and at least one non-transitory computer-readable medium storing instructions that, when executed by the at least one processor, cause the data management system to perform the method, the method comprising:

• receiving, by a data service of the data management system, an access token and a data access request from a client system, the data access request comprising an indication of a specified data set and an indication of an operation associated with at least one requested access privilege;
• validating the data access request by authenticating the access token;
• issuing, by the data service, an access control request to a security service of the data management system, the access control request comprising an indication of a subject associated with the access token, an indication of an object associated with the specified data set, and an indication of the at least one requested access privilege;
• identifying, by the security service, at least a first governed object in a directory database, the at least a first governed object corresponding with the indication of the object associated with the specified data set of the access control request;
• identifying, by the security service, at least a first rule set in the directory database, the at least a first rule set being associated with the at least a first governed object in the directory database, the at least a first rule set comprising at least a first rule specifying a depth associated with the at least a first rule, the at least a first rule set being attached to at least a second governed object located above the at least a first governed object in a root path of a directory tree in the directory database, the at least a second governed object being located above the at least a first governed object within the depth specified in the at least a first rule;
• identifying, by the security service, at least a first role in the directory database, the at least a first role being associated with the indication of the subject associated with the access token;
• determining, by the security service, based on the at least a first rule, the at least a first role, and the access control request, that the access control request should be granted, wherein determining that the access control request should be granted comprises:
• comparing the indication of the subject associated with the access token, the at least a first role, the indication of the object associated with the specified data set, and the indication of the at least one requested access privilege with the at least a first rule, and
• determining, based on the comparison, that the subject associated with the access token is permitted the at least one requested access privilege to the object associated with the specified data set;
• issuing, by the security service to the data service, an access control response granting access to the specified data set based on the determination;
• and
• permitting, by the data service, access to the specified data set by the client system in accordance with the access control response.