# US 2017/0286265 A1 · Privilege Test and Monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286265 A1 - Document ID: US20170286265A1 - Status: Published application - Kind: A1 - Application number: 15/171,936 - Filed: 2016-06-02 - Published: 2017-10-05 - Earliest claimed: 2016-03-31 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Andreas Leon Aagaard Moth; Boaz Lev; Predrag Borivoje Maricic; Thomas Andersen - Web page: https://patentgrep.com/patent/US20170286265A1 ## CPC - G06F 11/3644: {by instrumenting at runtime} - G06F 11/3672: {Test management} - G06F 11/3688: {for test execution, e.g. scheduling of test suites} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Testing code. A method includes identifying in code being executed on a computing system a specification of a permission set. The method further includes dynamically, as the code is running changing a permission level of the computing system to match the permission set. The method further includes executing code at the computing system within the permissions in the permission set. The method further includes during execution, for actions performed in the execution, determining if the permission set includes sufficient permissions for the action to be performed. ## Claims ### Claim 1 A system comprising: one or more processors; and one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to test code, including instructions that are executable to configure the computer system to perform at least the following: identify in code being executed on a computing system a specification of a permission set; dynamically, as the code is running change a permission level of the computing system to match the permission set; execute code at the computing system within the permissions in the permission set, such that the code is run under different permission sets; and during execution, for actions performed in the execution, determine if the permission set includes sufficient permissions for the action to be performed. ### Claim 2 (depends on 1) The system of claim 1, wherein one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to determine that privileges are missing for the action to be performed, and as a result, abort code execution and providing an error message. ### Claim 3 The system of claim I, wherein one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to determine that privileges are missing for the action to be performed, but continue code execution as a result of determining that the action not able to be performed is not essential to continuing code execution, and add identified missing privileges to a list that can be provided to a user. ### Claim 4 (depends on 1) The system of claim 1, wherein embodiments use alternative permission sets for different sets of functions as a result of dynamically changing permission sets such that different portions of the code are executed using different permission sets. ### Claim 5 The system of claim I, wherein one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to iteratively use different permission sets for the same portions of code. ### Claim 6 (depends on 1) The system of claim 1, wherein one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to identify that sufficient permissions are not included in the permission set to perform a given function, and as a result identify the needed permission and specify the needed permission to a user. ### Claim 7 (depends on 1) The system of claim 1, wherein one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to perform the following: as actions are being performed, identify which permissions are needed to perform each given action; identify which permissions are available in the permission set for particular actions; identify which permissions are not available in the permission set for particular actions; and identify to a user, a correlation of permissions to actions, ### Claim 8 (depends on 7) The system of claim 7, wherein the correlation of permissions to actions identifies which permissions are included in the permission set and which permissions are not included in the permission set. ### Claim 9 A method of testing code, the method comprising: identifying in code being executed on a computing system a specification of a permission set; dynamically, as the code is running changing a permission level of the computing system to match the permission set; executing code at the computing system within the permissions in the permission set, such that the code is run under different permission sets; and during execution, for actions performed in the execution, determining if the permission set includes sufficient permissions for the action to be performed. ### Claim 10 (depends on 9) The method of claim 9, further comprising determining that privileges are missing for the action to be performed, and as a result, aborting code execution and providing an error message. ### Claim 11 (depends on 9) The method of claim 9, further comprising determining that privileges are missing for the action to be performed, but continuing code execution as a result of determining that the action not able to be performed is not essential to continuing code execution, and adding identified missing privileges to a list that can be provided to a user. ### Claim 12 (depends on 9) The method of claim 9, wherein embodiments use alternative permission sets for different sets of functions as a result of dynamically changing permission sets. ### Claim 13 (depends on 1) The method of claim 1, further comprising iteratively using different permission set for the same portions of code as a result of dynamically changing permission sets. ### Claim 14 (depends on 9) The method of claim 9, further comprising identifying that sufficient permissions are not included in the permission set to perform a given function, and as a result identifying the needed permission and specifying the needed permission to a user. ### Claim 15 (depends on 9) The method of claim 9, further comprising: as actions are being performed, identifying which permissions are needed to perform each given action; identifying which permissions are available in the permission set for particular actions; identifying which permission are not available in the permission set for particular actions; and identifying to a user, a correlation of permissions to actions. ### Claim 16 (depends on 15) The method of claim 15, wherein the correlation of permission to actions identifies which permissions are included in the permission set and which permissions are not included in the permission set. ### Claim 17 (depends on 9) The method of claim 9, further comprising identifying in the code a new permission set defined in the code; and dynamically as the code is running, changing a permission level to match the new permission set. ### Claim 18 A method of identifying missing privileges, the method comprising: identifying actions attempted to be performed by an entity recording which permissions are needed to perform the identified actions; enumerating the permissions needed to perform the identified actions; and providing the enumeration of permissions to a user. ### Claim 19 (depends on 18) The method of claim 18, wherein recording which permissions are needed comprises at each individual action determining if the entity has permission, and if the entity does have the permission, noting that the entity possesses the permission, and if the entity does not have the permission, noting that the entity does not possess the permission. ### Claim 20 (depends on 19) The method of claim 19, wherein providing the enumeration of permissions to a user comprises identifying which permissions the entity has and which permissions the entity does not have.