# US 12,762,255 B2 · Protecting workflow security by up-front authorization and capacity-scoped cryptographic security context > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,255 B2 - Document ID: US12762255B2 - Status: Granted - Kind: B2 - Application number: 18/486,317 - Filed: 2023-10-13 - Published: 2025-04-17 - Granted: 2026-10-13 - Earliest claimed: 2023-10-13 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Daniel K. O'Reilly, Jr.; Chooi Peng Low; Yi Fang; Ranjit Kollu; Jonathon Cwik; Ching-Yun Chao - Web page: https://patentgrep.com/patent/US12762255B2 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Up front authorization of a workflow and a security context for workflow execution are disclosed. All possible authorizations that may be required by a workflow are identified up front. A requestor is allowed to execute the workflow only when the authorizations of the user include the authorizations that may be required by the workflow. A security context is generated and associated with the workflow or an instance thereof. The security context scopes or limits the workflow to at least the type or capacity of work requested, work uniquely identified in the security context, and/or service/workflow/call paths that the request is allowed to be processed through. ## Claims ### Claim 1 A method comprising: receiving a request to perform a workflow from a requestor; scanning a workflow definition of the workflow to identify maximum authorizations associated with the workflow, wherein the maximum authorizations include all authorizations required to execute the workflow and any child workflow, which is a child of the workflow; determining, prior to initiating execution of an instance of the workflow, whether the requestor has the maximum authorizations required to perform the instance of the workflow; generating an access token that is associated with the instance of the workflow only after determining that the requestor has the maximum authorizations required to perform the instance of the workflow, wherein the access token is configured for token-based authentication, and wherein the access token informs services used by the instance of the workflow that the requestor is authorized to access the services; generating a security context for the instance of the workflow, wherein the security context places limits on the instance of the workflow by defining a permitted service, wherein the security context is configured to limit a type of work requested for the instance of the workflow, scope a capacity of the work requested for the instance of the workflow, or define a call path of the instance of the workflow, and wherein the security context is bound to the instance of the workflow; and performing the execution of the instance of the workflow in a computing environment, wherein each service accessed during the execution of the instance of the workflow determines whether to perform services based on the access token and the security context, including verifying that a requested service is within the permitted service, the workflow, or call path defined by the security context prior to performing the requested service, and wherein the security context places the limits on the instance of the workflow even when the requestor is otherwise authorized. ### Claim 2 (depends on 1) The method of claim 1, further comprising storing the maximum authorizations in a database. ### Claim 3 (depends on 2) The method of claim 2, further comprising comparing authorizations of the requestor to the maximum authorizations to determine whether the requestor is able to execute the workflow, wherein the requestor is able to execute the workflow when the authorizations of the requestor include the maximum authorizations. ### Claim 4 (depends on 1) The method of claim 1, wherein the security context is valid only for work uniquely identified in the security context. ### Claim 5 (depends on 1) The method of claim 1, further comprising managing a lifecycle of the access token and the security context. ### Claim 6 (depends on 5) The method of claim 5, further comprising revoking the access token and/or the security context when the instance of the workflow finishes. ### Claim 7 A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising: receiving a request to perform a workflow from a requestor; scanning a workflow definition of the workflow to identify maximum authorizations associated with the workflow, wherein the maximum authorizations include all authorizations required to execute the workflow and any child workflow, which is a child of the workflow; determining, prior to initiating execution of an instance of the workflow, whether the requestor has the maximum authorizations required to perform the instance of the workflow; generating an access token that is associated with the instance of the workflow only after determining that the requestor has the maximum authorizations required to perform the instance of the workflow, wherein the access token is configured for token-based authentication, and wherein the access token informs services used by the instance of the workflow that the requestor is authorized to access the services; generating a security context for the instance of the workflow, wherein the security context places limits on the instance of the workflow by defining a permitted service, wherein the security context is configured to limit a type of work requested for the instance of the workflow, scope a capacity of the work requested for the instance of the workflow, or define a path of the instance of the workflow, and wherein the security context is bound to the instance of the workflow; and performing the execution of the instance of the workflow in a computing environment, wherein each service accessed during the execution of the instance of the workflow determines whether to perform services based on the access token and the security context, including verifying that a requested service is within the permitted service, the workflow, or call path defined by the security context prior to performing the requested service, and wherein the security context places the limits on the instance of the workflow even when the requestor is otherwise authorized. ### Claim 8 (depends on 7) The non-transitory storage medium of claim 7, further comprising storing the maximum authorizations in a database. ### Claim 9 (depends on 8) The non-transitory storage medium of claim 8, further comprising comparing authorizations of the requestor to the maximum authorizations to determine whether the requestor is able to execute the workflow, wherein the requestor is able to execute the workflow when the authorizations of the requestor include the maximum authorizations. ### Claim 10 (depends on 7) The non-transitory storage medium of claim 7, wherein the security context is valid only for work uniquely identified in the security context. ### Claim 11 (depends on 7) The non-transitory storage medium of claim 7, further comprising managing a lifecycle of the access token and the security context. ### Claim 12 (depends on 11) The non-transitory storage medium of claim 11, further comprising revoking the access token and/or the security context when the instance of the workflow finishes.