# US 2018/0026989 A1 · Systems and methods for processing access permission type-specific access permission requests in an enterprise > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026989 A1 - Document ID: US20180026989A1 - Status: Published application - Kind: A1 - Application number: 15/214,916 - Filed: 2016-07-20 - Published: 2018-01-25 - Earliest claimed: 2016-07-20 - Assignees: Varonis Systems, Inc. - Applicants: Varonis Systems Inc. - Inventors: Yakov FAITELSON; Ohad KORKUS; Ophir KRETZER-KATZIR; David BASS - Web page: https://patentgrep.com/patent/US20180026989A1 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/104: {Grouping of entities} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system including a processor and a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to process access permission type-specific access permission requests from enterprise users in an enterprise, the system including access permission type-specific access permission request receiving functionality operable for receiving at least one request for at least one access permission type-specific access permission of at least one user to at least one data element in the enterprise, and access permission type-specific access permission request output providing functionality operable for employing information pertaining to ones of the enterprise users having similarities to the at least one user with respect to at least the access permission type-specific access permission to the data elements in order to provide an output indication of perceived appropriateness of grant of the request. ## Claims ### Claim 1 A method for processing access permission type-specific access permission requests from enterprise users in an enterprise, the method comprising: receiving at least one request for at least one access permission type-specific access permission of at least one user to at least one data element in said enterprise; and employing information pertaining to ones of said enterprise users having similarities to said at least one user with respect to at least said access permission type-specific access permission to said data elements in order to provide an output indication of perceived appropriateness of grant of said request. ### Claim 2 (depends on 1) A method for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 1 and also comprising: employing said output indication to provide a recommendation to an access permission approver as to whether to at least one of approve, disapprove, approve in part, approve in an expanded form and conditionally approve said at least one request. ### Claim 3 (depends on 2) A method for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 2 and wherein said recommendation to an access permission approver as to whether to at least one of approve, disapprove and conditionally approve said at least one request is based on at least one of the following conditions: that the requesting user retains said similarity to said ones of said enterprise users; that at least one additional access permission approver approves said request; and that said approval is limited in time. ### Claim 4 A system comprising a processor and a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to process access permission type-specific access permission requests from enterprise users in an enterprise, said system comprising: access permission type-specific access permission request receiving functionality operable for receiving at least one request for at least one access permission type-specific access permission of at least one user to at least one data element in said enterprise; and access permission type-specific access permission request output providing functionality operable for employing information pertaining to ones of said enterprise users having similarities to said at least one user with respect to at least said access permission type-specific access permission to said data elements in order to provide an output indication of perceived appropriateness of grant of said request. ### Claim 5 (depends on 4) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 4 and also comprising: access permission type-specific access permission recommendation providing functionality operable for employing said output indication to provide a recommendation to an access permission approver as to whether to at least one of approve, disapprove, approve in part, approve in an expanded form and conditionally approve said at least one request. ### Claim 6 (depends on 5) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 5 and wherein said access permission type-specific access permission recommendation providing functionality is operable for employing said output indication to provide a recommendation to an access permission approver as to whether to at least one of approve, disapprove and conditionally approve said at least one request based on at least one of the following conditions: that the requesting user retains said similarity to said ones of said enterprise users; that at least one additional access permission approver approves said request; and that said approval is limited in time. ### Claim 7 (depends on 4) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 4 and wherein said system resides on a computer server. ### Claim 8 (depends on 7) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 7 and wherein said computer server is connected to an enterprise network. ### Claim 9 (depends on 7) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 7 and wherein said computer server is connected to the internet. ### Claim 10 (depends on 4) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 4 and wherein said access permission type-specific access permission request receiving functionality is operable for receiving said at least one request from a user employing a computing device communicating therewith. ### Claim 11 A method for processing access permission type-specific access permission requests from enterprise users in an enterprise, the method comprising: receiving at least one request for at least one access permission type-specific access permission of at least one user to at least one data element among a multiplicity of data elements in said enterprise; and employing information pertaining to ones of said multiplicity of data elements in said enterprise having similarities to said at least one data element with respect to access permissions of at least some of said enterprise users thereto, in order to provide an output indication of perceived appropriateness of grant of said request. ### Claim 12 (depends on 11) A method for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 11 and also comprising: employing said output indication to provide a recommendation to an access permission approver as to whether to at least one of approve, disapprove, approve in part, approve in an expanded form and conditionally approve said at least one request. ### Claim 13 (depends on 12) A method for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 12 and wherein said recommendation to an access permission approver as to whether to at least one of approve, disapprove and conditionally approve said at least one request is based on at least one of the following conditions: that said at least one data element retains said similarity to said ones of said multiplicity of data elements; that at least one additional access permission approver approves said request; and that said approval is limited in time. ### Claim 14 A system comprising a processor and a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to process access permission type-specific access permission requests from enterprise users in an enterprise, said system comprising: access permission type-specific access permission request receiving functionality operable for receiving at least one request for at least one access permission type-specific access permission of at least one user to at least one data element among a multiplicity of data elements in said enterprise; and access permission type-specific access permission request output providing functionality operable for employing information pertaining to ones of said multiplicity of data elements in said enterprise having similarities to said at least one data element with respect to access permissions of at least some of said enterprise users thereto, in order to provide an output indication of perceived appropriateness of grant of said request. ### Claim 15 (depends on 14) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 14 and also comprising: access permission type-specific access permission recommendation providing functionality operable for employing said output indication to provide a recommendation to an access permission approver as to whether to at least one of approve, disapprove, approve in part, approve in an expanded form and conditionally approve said at least one request. ### Claim 16 (depends on 15) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 15 and wherein said access permission type-specific access permission recommendation providing functionality is operable for employing said output indication to provide a recommendation to an access permission approver as to whether to at least one of approve, disapprove and conditionally approve said at least one request includes a recommendation to conditionally approve based on at least one of the following conditions: that said at least one data element retains said similarity to said ones of said multiplicity of data elements; that at least one additional access permission approver approves said request; and that said approval is limited in time. ### Claim 17 (depends on 14) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 14 and wherein said system resides on a computer server. ### Claim 18 (depends on 17) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 17 and wherein said computer server is connected to an enterprise network. ### Claim 19 (depends on 17) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 17 and wherein said computer server is connected to the internet. ### Claim 20 (depends on 14) A system for processing access permission type-specific access permission requests from enterprise users in an enterprise according to claim 14 and wherein said access permission type-specific access permission request receiving functionality is operable for receiving said at least one request from a user employing a computing device communicating therewith.