Relationship-based authorization

A computer-implemented method comprising:

• receiving data characterizing a request for authorization to access a computer-based resource by a principal;
• determining whether the requesting principal is authorized for the access to the computer-based resource, the determining comprising:
• determining whether the requesting principal has a relationship with a principal that has management rights of access to the computer-based resource;
• and
• determining whether the relationship allows for the access to the computer-based resource if the requesting principal has a relationship with the principal that has management rights;
• otherwise, determining whether an organization of the requesting principal has a relationship, with the principal that has management rights, that allows for the access;
• and
• providing authorization for the requesting principal to the computer-based resource.

A non-transitory computer program product, tangibly embodied in a computer-readable media, the computer program product comprising instructions to cause data processing apparatus to perform operations comprising:

• receiving data characterizing a request for access to a computer-based resource by a first principal;
• determining whether the first principal is authorized for the access to the computer-based resource, the determining comprising:
• determining whether the first principal has a first relationship with a second principal that has management rights of access to the computer-based resource, the determining whether the first principal has the first relationship with the second principal based on a query of one or more data structures comprising user to user relationships between principals being users;
• and
• determining whether the first relationship allows for the access to the computer-based resource based on properties of the first relationship if the first principal has the first relationship;
• otherwise, determining whether an organization of the first principal has a second relationship, with the second principal, that allows for the access, the determining whether the organization has the second relationship based on user to organization relationships and organization to user relationships of the data structures;
• and
• providing authorization for the requesting principal to the computer-based resource.