# US 11,909,743 B1 · Organization-level account on data platform > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,743 B1 - Document ID: US11909743B1 - Status: Granted - Kind: B1 - Application number: 18/352,059 - Filed: 2023-07-13 - Granted: 2024-02-20 - Earliest claimed: 2023-07-13 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: Christine A. Avanessians; Damien Carru; Ramachandran Natarajan Iyer; Dennis Edgar Lynch; Subramanian Muralidhar - Web page: https://patentgrep.com/patent/US11909743B1 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/102: {Entity profiles} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for an organization-level account for an organization on a data platform, users of which can possess administrative or management privileges with respect to the organization and across one or more others accounts of the organization. ## Claims ### Claim 1 A system comprising: a set of hardware processors; and memory storing instructions that cause the set of hardware processors to perform operations comprising: creating an organization-level account for a specified organization on a specified deployment of a data platform, the specified organization having a set of non-organization-level accounts, the organization-level account comprising a set of users; receiving a request from a user of the set of users to perform an administrative-level operation with respect to at least one non-organization-level account in the set of non-organization-level accounts; and in response to the request: determining a set of roles assigned to the user within the organization-level account; determining whether at least one role in the set of roles permits the user to perform the administrative-level operation with respect to the at least one non-organization-level account; and in response to determining that at least one role in the set of roles permits the user to perform the administrative-level operation with respect to the at least one non-organization-level account, performing the administrative-level operation with respect to the at least one non-organization-level account. ### Claim 2 (depends on 1) The system of claim 1, wherein the administrative-level operation comprises managing a new user or an existing user with respect to the at least one non-organization-level account. ### Claim 3 (depends on 1) The system of claim 1, wherein the administrative-level operation comprises managing a data object of the at least one non-organization-level account. ### Claim 4 (depends on 1) The system of claim 1, wherein the administrative-level operation comprises monitoring metadata of the at least one non-organization-level account. ### Claim 5 (depends on 1) The system of claim 1, wherein the administrative-level operation comprises at least one of viewing or managing an organization view of the at least one non-organization-level account. ### Claim 6 (depends on 1) The system of claim 1, wherein the administrative-level operation comprises switching into a context of the at least one non-organization-level account. ### Claim 7 (depends on 1) The system of claim 1, wherein the administrative-level operation comprises moving the at least one non-organization-level account from a first deployment of the data platform to a second deployment of the data platform. ### Claim 8 (depends on 1) The system of claim 1, wherein the request is a first request, wherein the administrative-level operation is a first administrative-level operation, and where the operations comprise: receiving a second request from the user to perform a second administrative-level operation with respect to the specified organization; and in response to the second request: determining whether at least one role in the set of roles permits the user to perform the second administrative-level operation with respect to the specified organization; and in response to determining that at least one role in the set of roles permits the user to perform the second administrative-level operation with respect to the specified organization, performing the second administrative-level operation with respect to the specified organization. ### Claim 9 (depends on 8) The system of claim 8, wherein the second administrative-level operation comprises merging the specified organization into a target organization. ### Claim 10 (depends on 9) The system of claim 9, wherein a merged organization is generated by the merging of the specified organization into the target organization, and wherein the second administrative-level operation causes the organization-level account of the specified organization to be retained for the merged organization. ### Claim 11 (depends on 9) The system of claim 9, wherein the organization-level account is a first organization-level account of the specified organization, wherein a merged organization is generated by the merging of the specified organization into the target organization, and wherein the second administrative-level operation causes a second organization-level account of the target organization to be retained for the merged organization. ### Claim 12 (depends on 9) The system of claim 9, wherein the organization-level account is a first organization-level account of the specified organization, wherein a merged organization is generated by the merging of the specified organization into the target organization, and wherein the second administrative-level operation causes a second organization-level account to be generated for the merged organization. ### Claim 13 (depends on 8) The system of claim 8, wherein the second administrative-level operation comprises moving the organization-level account from the specified deployment to a target deployment of the data platform. ### Claim 14 (depends on 8) The system of claim 8, wherein the organization-level account is a primary organization-level account of the specified organization, and wherein the second administrative-level operation comprises enabling failover for the primary organization-level account using one or more secondary organization-level accounts. ### Claim 15 (depends on 14) The system of claim 14, wherein the second administrative-level operation causes each of the one or more secondary organization-level accounts to be generated on a different deployment on the data platform, each different deployment being different from the specified deployment. ### Claim 16 (depends on 14) The system of claim 14, wherein the second administrative-level operation causes data replication from the primary organization-level account to at least one of the one or more secondary organization-level accounts to be established. ### Claim 17 (depends on 14) The system of claim 14, wherein the user is a first user of the primary organization-level account, and wherein any user of a secondary organization-level account is limited to requesting a set of read-only administrative-level operations. ### Claim 18 (depends on 14) The system of claim 14, wherein the primary organization-level account is an existing primary organization-level account of the specified organization, and wherein the operations comprise: detecting failure of the specified deployment; and in response to detecting the failure, causing a secondary organization-level account of the one or more secondary organization-level accounts to be set as a new primary organization-level account of the specified organization. ### Claim 19 (depends on 8) The system of claim 8, wherein the second administrative-level operation comprises management of an organization-level data object of the specified organization. ### Claim 20 A method comprising: creating, by at least one hardware processor, an organization-level account for a specified organization on a specified deployment of a data platform, the specified organization having a set of non-organization-level accounts, the organization-level account comprising a set of users; receiving, at the specified deployment, a request from a user of the set of users to perform an administrative-level operation with respect to at least one non-organization-level account in the set of non-organization-level accounts; and in response to the request: determining, by the specified deployment, a set of roles assigned to the user within the organization-level account; determining, by the specified deployment, whether at least one role in the set of roles permits the user to perform the administrative-level operation with respect to the at least one non-organization-level account; and in response to determining that at least one role in the set of roles permits the user to perform the administrative-level operation with respect to the at least one non-organization-level account, performing, by the specified deployment, the administrative-level operation with respect to the at least one non-organization-level account. ### Claim 21 (depends on 20) The method of claim 20, wherein the administrative-level operation comprises managing a new user or an existing user with respect to the at least one non-organization-level account. ### Claim 22 (depends on 20) The method of claim 20, wherein the administrative-level operation comprises managing a data object of the at least one non-organization-level account. ### Claim 23 (depends on 20) The method of claim 20, wherein the administrative-level operation comprises at least one of viewing or managing an organization view of the at least one non-organization-level account. ### Claim 24 (depends on 20) The method of claim 20, wherein the administrative-level operation comprises switching into a context of the at least one non-organization-level account. ### Claim 25 (depends on 20) The method of claim 20, wherein the administrative-level operation comprises moving the at least one non-organization-level account from a first deployment of the data platform to a second deployment of the data platform. ### Claim 26 (depends on 20) The method of claim 20, wherein the request is a first request, wherein the administrative-level operation is a first administrative-level operation, and where the method comprises: receiving, at the specified deployment, a second request from the user to perform a second administrative-level operation with respect to the specified organization; and in response to the second request: determining, by the specified deployment, whether at least one role in the set of roles permits the user to perform the second administrative-level operation with respect to the specified organization; and in response to determining that at least one role in the set of roles permits the user to perform the second administrative-level operation with respect to the specified organization, performing, by the specified deployment, the second administrative-level operation with respect to the specified organization. ### Claim 27 (depends on 26) The method of claim 26, wherein the second administrative-level operation comprises merging the specified organization into a target organization. ### Claim 28 (depends on 26) The method of claim 26, wherein the second administrative-level operation comprises moving the organization-level account from the specified deployment to a target deployment of the data platform. ### Claim 29 (depends on 26) The method of claim 26, wherein the organization-level account is a primary organization-level account of the specified organization, and wherein the second administrative-level operation comprises enabling failover for the primary organization-level account using one or more secondary organization-level accounts. ### Claim 30 A machine-storage medium comprising instructions that, when executed by one or more hardware processors of a machine, configure the machine to perform operations comprising: creating an organization-level account for a specified organization on a specified deployment of a data platform, the specified organization having a set of non-organization-level accounts, the organization-level account comprising a set of users; receiving a request from a user of the set of users to perform an administrative-level operation with respect to at least one non-organization-level account in the set of non-organization-level accounts; and in response to the request: determining a set of roles assigned to the user within the organization-level account; determining whether at least one role in the set of roles permits the user to perform the administrative-level operation with respect to the at least one non-organization-level account; and in response to determining that at least one role in the set of roles permits the user to perform the administrative-level operation with respect to the at least one non-organization-level account, performing the administrative-level operation with respect to the at least one non-organization-level account.