Extensibility tools for defining custom restriction rules in access control

A system comprising:

• at least one processor;
• and
• a memory communicatively coupled to the at least one processor, the memory storing instructions which, when executed, cause the at least one processor to perform operations comprising:
• presenting, via a user interface, a listing of a plurality of restriction rules for association with a particular business role, the business role associated with at least one end user in an enterprise software system executed by a customer, the listing of the plurality of restriction rules including at least one predefined restriction rule and at least one custom restriction rule placeholder, wherein each of the at least one predefined restriction rules are delivered with the enterprise software system and defined by a software vendor providing the enterprise software system, and wherein each of the at least one customer restriction rule placeholders are associated with a link to custom code developed as a customer-specific restriction rule;
• receiving, via the user interface, an indication of a selection of a particular custom restriction rule placeholder from the listing of the plurality of restriction rules;
• associating the selected particular custom restriction rule placeholder with the particular business role;
• in response to a triggering event associated with the evaluation of the restriction rule for the particular business role:
• accessing the custom code linked to the particular custom restriction rule placeholder;
• accessing a set of master data defined in the custom code used to determine restrictions to be associated with each of the end users associated with the particular business role;
• and
• deriving, based on logic defined within the custom code, a set of access objects associated with the accessed set of master data to be associated with each end user;
• and
• generating, for each end user associated with the identified business role, an end user authorization identifying the set of access objects authorized for the particular end user to access at runtime.

A non-transitory computer-readable medium storing instructions which, when executed, cause at least one processor to perform operations comprising:

• presenting, via a user interface, a listing of a plurality of restriction rules for association with a particular business role, the business role associated with at least one end user in an enterprise software system executed by a customer, the listing of the plurality of restriction rules including at least one predefined restriction rule and at least one custom restriction rule placeholder, wherein each of the at least one predefined restriction rules are delivered with the enterprise software system and defined by a software vendor providing the enterprise software system, and wherein each of the at least one customer restriction rule placeholders are associated with a link to custom code developed as a customer-specific restriction rule;
• receiving, via the user interface, an indication of a selection of a particular custom restriction rule placeholder from the listing of the plurality of restriction rules;
• associating the selected particular custom restriction rule placeholder with the particular business role;
• in response to a triggering event associated with the evaluation of the restriction rule for the particular business role:
• accessing the custom code linked to the particular custom restriction rule placeholder;
• accessing a set of master data defined in the custom code used to determine restrictions to be associated with each of the end users associated with the particular business role;
• and
• deriving, based on logic defined within the custom code, a set of access objects associated with the accessed set of master data to be associated with each end user;
• and
• generating, for each end user associated with the identified business role, an end user authorization identifying the set of access objects authorized for the particular end user to access at runtime.