Access control using roles and multi-dimensional constraints

A computer-readable medium comprising instructions, that when executed by a computer, cause the computer to:

• assign a first user a particular role of a plurality of roles;
• assign a second user the particular role;
• associate the first user with a first multi-dimensional constraint that defines access restrictions with respect to the first user in a plurality of dimensions;
• associate the second user with a second multi-dimensional constraint that defines access restrictions with respect to the second user in the plurality of dimensions;
• receive a first request from the first user to perform an operation permitted by the role, wherein the first multi-dimensional constraint allows the first user to perform the operation;
• receive a second request from the second user to perform the operation permitted by the role, wherein the second multi-dimensional constraint does not allow the second user to perform the operation;
• grant the first request;
• and
• deny the second request.

A computer system, comprising:

• a processor;
• a memory coupled to the processor, the memory comprising instructions, that when executed by the processor, cause the processor to execute a security system comprising:
• a plurality of permissions, each permission enabling performance of a particular operation of a plurality of operations with respect to a particular object of a plurality of objects or a particular messaging event of a plurality of messaging events;
• an administration module configured to:
• assign one or more roles to each user of a plurality of users;
• determine one or more dimensions based on the plurality of objects or messaging events;
• determine one or more multi-dimensional constraints based on the one or more dimensions, each multi-dimensional constraint restricting a permission associated with one or more of a role and a user;
• and
• associate each of the plurality of users with one or more of the plurality of multi-dimensional constraints with respect to the particular role;
• and
• a run-time module configured to:
• receive an access request from a particular user during a session of the security system;
• perform a role validation comprising determining whether the particular user is assigned a role that permits the access request;
• perform a constraint validation comprising determining whether the particular user is associated with a multi-dimensional constraint that allows the particular user to complete the access request;
• and
• grant or deny the access request based on the role validation and the constraint validation.