Secure data access management system

A system comprising:

• computer-readable memory storing executable instructions;
• and
• one or more computing devices programmed by the executable instructions to at least:
• generate an output data set using a first data item from a first base data set and a second data item from a second base data set, wherein the first data item is associated with a first access level of a plurality of access levels, and wherein the second data item is associated with a second access level of the plurality of access levels;
• determine, based at least partly on the second access level being a higher level within an access level hierarchy than the first access level, to associate the second access level with the output data set;
• and
• generate access metadata for the output data set, wherein the access metadata represents an association of the second access level to the output data set, and wherein access to the output data set is limited to data accessors associated with the second access level.

A data storage system comprising:

• a data store comprising physical data storage media, wherein data stored on the physical data storage media is organized into a plurality of buckets associated with a data provider, wherein a first bucket of the plurality of buckets is associated with a first access level of an access level hierarchy, and wherein a second bucket of the plurality of buckets is associated with a second access level of the access level hierarchy;
• and
• a data governor comprising one or more computing devices, wherein the data governor is configured to at least:
• generate a derived data set using a first data item from a first base data set and a second data item from a second base data set, wherein the first data item is associated with first access metadata representing an assignment of the first access level to the first data item, and wherein the second data item is associated with second access metadata representing an assignment of the second access level to the second data item;
• determine, based at least partly on the second access level being a higher level within the access level hierarchy than the first access level, to assign the second access level to the derived data set;
• generate third access metadata for the derived data set, wherein the third access metadata represents an assignment of the second access level to the derived data set;
• and
• store the derived data set in the second bucket based at least partly on the derived data set being assigned the second access level, wherein access to the derived data set is restricted to data accessors associated with at least the second access level.