Managing access control within system topologies using canonical access control representations

A system comprising:

• a plurality of accessibles within a topology accessible via at least one access control method;
• a plurality of accessors within the topology, each accessor having a predetermined level of access to each of one or more of the plurality of accessibles via one or more of the at least one access control method;
• and,
• a computer-readable medium storing data representing a mathematically canonical representation of access of the plurality of accessors to the plurality of accessibles, the representation including at least one zone, each zone specifying one or more of the plurality of accessors having access to one or more of the plurality of accessibles,
• the canonical representation satisfying a plurality of constraints comprising:
• a first constraint specifying that, for each zone, each of the one more accessors of the zone has identical access to each of the one or more accessibles of the zone;
• a second constraint specifying that each of the plurality of accessibles belongs to no more than one of the at least one zone;
• and,
• a third constraint specifying that the at least one zone encompass largest sets of the plurality of accessors that satisfy the first and the second constraints.

An article of manufacture comprising:

• a computer-readable medium;
• and,
• means in the medium for managing access of a plurality of accessors within a system topology to a plurality of accessibles within the system topology by using a mathematically canonical set of zones, each zone specifying one or more of the plurality of accessors having access to one or more of the plurality of accessibles,
• the canonical set of zones satisfying a plurality of constraints comprising:
• a first constraint specifying that, for each zone, each of the one more accessors of the zone has identical access to each of the one or more accessibles of the zone;
• a second constraint specifying that each of the plurality of accessibles belongs to no more than one zone;
• and,
• a third constraint specifying that the canonical set of zones encompasses largest sets of the plurality of accessors that satisfy the first and the second constraints.