Systems and methods for dynamic granular access permissions

A method, comprising:

• storing permanent access control permissions for users of an application in a database, wherein the permanent access control permissions are role-based authorizations that determine a level of access the users have within the application, and the users are assigned to roles that align with their roles in an organization's hierarchy or the application;
• providing a user interface configured to receive one or more credentials used to authenticate a first user of the users, wherein the user interface includes a user management process that provides tools for adding, updating, and deleting users, and the management process changes the permanent access permissions in the access permission database;
• providing the user interface including only actions that are permitted for the first user, and at least one of the actions is modified on the user interface based on a temporal limitation;
• determining a set of temporary access permissions for the first user based on the respective permanent access control permissions, after an authentication of a first user, wherein the set of temporary access permissions are role-based authorizations;
• providing an event handler that dynamically modifies at least one temporary access permission for the first user by applying to the first user at least one selected access control permission from a group of a scope limited access control permission and a temporally limited access control permission, wherein the selected access control permission is an attribute-based authorization based on one or more policies created to apply a non-role-based authorization for the first user within the application, wherein the one or more policies include a policy based on a business rule that the first user is not allowed to edit product descriptions during a specific time, and the one or more policies fit into a pattern for the application and logic is used to make determinations about a user's access permission based on the pattern;
• and
• providing an authorization process that determines whether a request from the user interface is authorized before processing the request from an administrator, using the temporary access permissions, and the at least one selected access control permission, wherein:
• the attribute-based authorization provides a level of authority that is tied to the one or more policies associated with the application and is independent of the user roles within the organization's hierarchy or application, the level of authority determines what authorization the first user has within the application, and
• the application comprises an administration application configured to expand, create, or limit role-based access permissions without having to add new roles or updates to a front end application, which allows configurable permutations of roles per user and per component as the application evolves over time.

A non-transitory computer-accessible medium having stored thereon computer-executable instructions for dynamic and granular user access permissions, wherein upon execution by a computer arrangement comprising a processor, the instructions cause the computer arrangement to perform procedures comprising:

• providing a database interface to an access control permissions database that stores at least one of roles, actions, or policies for users;
• providing a user interface for a first user of the users, wherein the user interface includes a user management process that provides tools for adding, updating, and deleting users, and the management process changes the permanent access permissions in the access permission database;
• providing the user interface including only actions that are permitted for the first user, and at least one of the actions is modified on the user interface based on a temporal limitation;
• providing a login process that authenticates the first user and determines a default set of access control permissions for the first user for the user interface, wherein the default access control permissions are role-based authorizations;
• accessing permanent access control permissions for the first user using the database interface, wherein the permanent access control permissions are role-based authorizations that determine a level of access the first user has, and the users are assigned to roles that align with their roles in an organization's hierarchy or the application;
• providing an event handler that dynamically modifies access to functionality in the user interface based on an event creating at least one temporary access control permission, wherein the at least one temporary access control permission is a scope limited or a temporally limited attribute-based authorization based on one or more policies created to determine a non-role-based authorization the user has within the application, wherein the one or more policies include a policy based on a business rule that the first user is not allowed to edit product descriptions during a specific time, and the one or more policies fit into a pattern for the application and logic is used to make determinations about a user's access permission based on the pattern;
• and
• providing an authorization process that determines whether a request from the user interface is authorized before processing the request from an administrator, using the permanent access control permissions from the administrator, and the at least one temporary access control permission, wherein:
• the attribute-based authorization provides a level of authority that is tied to the one or more policies associated with the application and is independent of the user roles within the organization's hierarchy or application,
• the level of authority determines what authorization the first user has within the application, and
• the application comprises an administration application configured to expand, create, or limit role-based access permissions without having to add new roles or updates to a front end application, which allows configurable permutations of roles per user and per component as the application evolves over time.