Fine granularity control of data access and usage across multi-tenant systems

A method comprising:

• receiving a request from a user to access a set of data from an associated data consent record at a remote data base for a specific purpose of developing or improving a machine learning (ML) feature;
• as a first phase of a three-phase authorization process validating, based on a role of the user, that the user has permission to request data access for an application associated with the request;
• verifying that the associated data consent record has granted the user access to the set of data for the specific purpose wherein the data consent record specifies the application, representing the machine learning feature, for which consent is granted and a list of consented data entities;
• as a second phase of the three-phase authorization process and responsive to successful validation and verification, generating a context-based token that defines a data scope and an operation scope for the request;
• generating a cloud neutral token from the context-based token and the associated data consent record
• as a third phase of the three-phase authorization process, converting the cloud neutral token into a cloud specific token and verifying the cloud specific token with backend services of a remote cloud system to apply security scope for data and operations;
• and
• in response to the user being authorized and verified via the three-phase authorization process:
• creating a temporary Identity and Access Management (IAM) role and a temporary IAM policy that allows restricted access to the set of data by the user according to the cloud specific token the temporary IAM role and policy being associated with a time to live value, and
• automatically deleting the temporary IAM role and temporary IAM policy after the time to live value expires.

A non-transitory computer readable medium storing instructions to cause a processor to execute a method, the method comprising:

• receiving a request from a user to access a set of data from an associated data consent record at a remote data base for a specific purpose of developing or improving a machine learning (ML) feature;
• as a first phase of a three-phase authorization process validating, based on a role of the user, that the user has permission to request data access for an application associated with the request;
• verifying that the associated data consent record has granted the user access to the set of data for the specific purpose wherein the data consent record specifies the application, representing the machine learning feature, for which consent is granted and a list of consented data entities;
• as a second phase of the three-phase authorization process and responsive to successful validation and verification, generating a context-based token that defines a data scope and an operation scope for the request;
• generating a cloud neutral token from the context-based token and the associated data consent record
• as a third phase of the three-phase authorization process, converting the cloud neutral token into a cloud specific token and verifying the cloud specific token with backend services of a remote cloud system to apply security scope for data and operations;
• and
• in response to the user being authorized and verified via the three-phase authorization process:
• creating a temporary Identity and Access Management (IAM) role and a temporary IAM policy that allows restricted access to the set of data by the user according to the cloud specific token the temporary IAM role and policy being associated with a time to live value, and
• automatically deleting the temporary IAM role and temporary IAM policy after the time to live value expires.