Managing access to data

An application computing device comprising a processor having access to memory media storing instructions executable by the processor to perform operations, including:

• receiving data indicating user-specific data access roles and user-specific data permissions for each of the user-specific data access roles, each of the user-specific data permissions defining encrypted data of a portion of a database that the corresponding user-specific data access role has authorization for decrypting the encrypted data;
• receiving a user token representing credentials and user-specific data access roles of an user;
• receiving a query for at least encrypted data stored by the database;
• comparing the user-specific data access role of the user token with the user-specific data access roles to identify user-specific data permissions for the user-specific data access role of the user token;
• and
• determining, based on the comparing, whether the user-specific data permissions for the user-specific data access role identified within the user token includes authorization for decrypting the requested encrypted data for the authorized user, and in response, performing actions based on such determination.

A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations, comprising:

• receiving data indicating user-specific data access roles and user-specific data permissions for each of the user-specific data access roles, each of the user-specific data permissions defining encrypted data of a portion of a database that the corresponding user-specific data access role has authorization for decrypting the encrypted data;
• receiving a user token representing credentials and user-specific data access roles of an user;
• receiving a query for at least encrypted data stored by the database;
• comparing the user-specific data access role of the user token with the user-specific data access roles to identify user-specific data permissions for the user-specific data access role of the user token;
• and
• determining, based on the comparing, whether the user-specific data permissions for the user-specific data access role identified within the user token includes authorization for decrypting the requested encrypted data for the user and in response, performing actions based on such determination.