Access controlled graph query spanning

A method for controlling access to one or more nodes in a relational graph, comprising:

• receiving a graph query including a subject security context;
• determining whether a node in the relational graph denies access to the node, the determining including determining at least one of (a) whether a deny Approximate Membership Query (AMQ) filter denies access to the node, or (b) whether a query deny list denies access to the node;
• and
• denying access to the node if it is determined that the node denies the access.

A method for controlling access to nodes in a relational graph, comprising:

• identifying frequencies at which security contexts are used to grant or deny access to the nodes in the relational graph;
• sorting permit lists and deny lists based on the identified frequencies;
• receiving a graph query on the relational graph;
• obtaining one or more security contexts for a subject;
• and
• ordering the security contexts for the subject, based on the identified frequencies.

A system for controlling access to one or more nodes in a relational graph, comprising:

• a memory storing a program;
• and
• a computer processor operating under control of the program to:
• receive a graph query including a subject security context,
• determine whether a node in the relational graph denies access to the node, by determining at least one of (a) whether a deny Approximate Membership Query (AMQ) filter denies access to the node, or (b) whether a query deny list denies access to the node, and
• deny access to the node if it is determined that the node denies the access.