# US 2019/0171842 A1 · Extensibility tools for defining custom restriction rules in access control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0171842 A1 - Document ID: US20190171842A1 - Status: Published application - Kind: A1 - Application number: 15/830,342 - Filed: 2017-12-04 - Published: 2019-06-06 - Earliest claimed: 2017-12-04 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Gerd M. Ritter; Bernd Fleddermann - Web page: https://patentgrep.com/patent/US20190171842A1 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/45: Structures or tools for the administration of authentication - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are described for providing extensibility tools to customers for defining custom restriction rules for enhanced access controls. In an example method, a listing of restriction rules available for a business role are presented. The restriction rules include predefined restriction rules and at least one custom restriction rule placeholder, wherein the predefined restriction rules are delivered with the enterprise software system the at least one customer restriction rule placeholders are associated with a link to custom code developed as a customer-specific restriction rule. A selection of a particular custom restriction rule is received and associated with the particular business role. When evaluating the restriction rule, the custom code and a set of master data defined in the custom code is accessed to determine restrictions for each of the end users associated with the business role. A set of access objects are derived for each user based on the information. ## Claims ### Claim 1 A computerized method executed by at least one processor, the method comprising: presenting, via a user interface, a listing of a plurality of restriction rules for association with a particular business role, the business role associated with at least one end user in an enterprise software system executed by a customer, the listing of the plurality of restriction rules including at least one predefined restriction rule and at least one custom restriction rule placeholder, wherein each of the at least one predefined restriction rules are delivered with the enterprise software system and defined by a software vendor providing the enterprise software system, and wherein each of the at least one customer restriction rule placeholders are associated with a link to custom code developed as a customer-specific restriction rule; receiving, via the user interface, an indication of a selection of a particular custom restriction rule placeholder from the listing of the plurality of restriction rules; associating the selected particular custom restriction rule placeholder with the particular business role; in response to a triggering event associated with the evaluation of the restriction rule for the particular business role: accessing the custom code linked to the particular custom restriction rule placeholder; accessing a set of master data defined in the custom code used to determine restrictions to be associated with each of the end users associated with the particular business role; and deriving, based on logic defined within the custom code, a set of access objects associated with the accessed set of master data to be associated with each end user; and generating, for each end user associated with the identified business role, an end user authorization identifying the set of access objects authorized for the particular end user to access at runtime. ### Claim 2 (depends on 1) The method of claim 1, wherein at least a portion of the master data associated with the custom code comprises customer-defined master data defined by the customer after delivery of the enterprise software system. ### Claim 3 (depends on 1) The method of claim 1, wherein the triggering event comprises a save action associated with an updated business role after the association of the selected custom restriction rule. ### Claim 4 (depends on 1) The method of claim 1, wherein the triggering event comprises a periodic restriction rule evaluation. ### Claim 5 (depends on 1) The method of claim 1, wherein the triggering event comprises an assignment of a new business role to a user. ### Claim 6 (depends on 1) The method of claim 1, the method further comprising, in response to receiving the request at runtime for a first set of data associated with a first end user: determining a subset of the requested first set of data included in the generated end user authorization; and providing the subset of the requested first set of data in the response to the request. ### Claim 7 (depends on 1) The method of claim 1, wherein the listing of the plurality of restriction rules including at least one custom restriction rule placeholder provided by a partner to the customer, the at least one customer restriction rule placeholder provided by the partner developed as a partner-defined restriction rule and made available for use by the customer. ### Claim 8 A system comprising: at least one processor; and a memory communicatively coupled to the at least one processor, the memory storing instructions which, when executed, cause the at least one processor to perform operations comprising: presenting, via a user interface, a listing of a plurality of restriction rules for association with a particular business role, the business role associated with at least one end user in an enterprise software system executed by a customer, the listing of the plurality of restriction rules including at least one predefined restriction rule and at least one custom restriction rule placeholder, wherein each of the at least one predefined restriction rules are delivered with the enterprise software system and defined by a software vendor providing the enterprise software system, and wherein each of the at least one customer restriction rule placeholders are associated with a link to custom code developed as a customer-specific restriction rule; receiving, via the user interface, an indication of a selection of a particular custom restriction rule placeholder from the listing of the plurality of restriction rules; associating the selected particular custom restriction rule placeholder with the particular business role; in response to a triggering event associated with the evaluation of the restriction rule for the particular business role: accessing the custom code linked to the particular custom restriction rule placeholder; accessing a set of master data defined in the custom code used to determine restrictions to be associated with each of the end users associated with the particular business role; and deriving, based on logic defined within the custom code, a set of access objects associated with the accessed set of master data to be associated with each end user; and generating, for each end user associated with the identified business role, an end user authorization identifying the set of access objects authorized for the particular end user to access at runtime. ### Claim 9 (depends on 8) The system of claim 8, wherein at least a portion of the master data associated with the custom code comprises customer-defined master data defined by the customer after delivery of the enterprise software system. ### Claim 10 (depends on 8) The system of claim 8, wherein the triggering event comprises a save action associated with an updated business role after the association of the selected custom restriction rule. ### Claim 11 (depends on 8) The system of claim 8, wherein the triggering event comprises a periodic restriction rule evaluation. ### Claim 12 (depends on 8) The system of claim 8, wherein the triggering event comprises an assignment of a new business role to a user. ### Claim 13 (depends on 8) The system of claim 8, the operations further comprising, in response to receiving the request at runtime for a first set of data associated with a first end user: determining a subset of the requested first set of data included in the generated end user authorization; and providing the subset of the requested first set of data in the response to the request. ### Claim 14 (depends on 8) The system of claim 8, wherein the listing of the plurality of restriction rules including at least one custom restriction rule placeholder provided by a partner to the customer, the at least one customer restriction rule placeholder provided by the partner developed as a partner-defined restriction rule and made available for use by the customer. ### Claim 15 A non-transitory computer-readable medium storing instructions which, when executed, cause at least one processor to perform operations comprising: presenting, via a user interface, a listing of a plurality of restriction rules for association with a particular business role, the business role associated with at least one end user in an enterprise software system executed by a customer, the listing of the plurality of restriction rules including at least one predefined restriction rule and at least one custom restriction rule placeholder, wherein each of the at least one predefined restriction rules are delivered with the enterprise software system and defined by a software vendor providing the enterprise software system, and wherein each of the at least one customer restriction rule placeholders are associated with a link to custom code developed as a customer-specific restriction rule; receiving, via the user interface, an indication of a selection of a particular custom restriction rule placeholder from the listing of the plurality of restriction rules; associating the selected particular custom restriction rule placeholder with the particular business role; in response to a triggering event associated with the evaluation of the restriction rule for the particular business role: accessing the custom code linked to the particular custom restriction rule placeholder; accessing a set of master data defined in the custom code used to determine restrictions to be associated with each of the end users associated with the particular business role; and deriving, based on logic defined within the custom code, a set of access objects associated with the accessed set of master data to be associated with each end user; and generating, for each end user associated with the identified business role, an end user authorization identifying the set of access objects authorized for the particular end user to access at runtime. ### Claim 16 (depends on 15) The computer readable medium of claim 15, wherein at least a portion of the master data associated with the custom code comprises customer-defined master data defined by the customer after delivery of the enterprise software system. ### Claim 17 (depends on 15) The computer readable medium of claim 15, wherein the triggering event comprises a save action associated with an updated business role after the association of the selected custom restriction rule. ### Claim 18 (depends on 15) The computer readable medium of claim 15, wherein the triggering event comprises an assignment of a new business role to a user. ### Claim 19 (depends on 15) The computer readable medium of claim 15, the operations further comprising, in response to receiving the request at runtime for a first set of data associated with a first end user: determining a subset of the requested first set of data included in the generated end user authorization; and providing the subset of the requested first set of data in the response to the request. ### Claim 20 (depends on 15) The computer readable medium of claim 15, wherein the listing of the plurality of restriction rules including at least one custom restriction rule placeholder provided by a partner to the customer, the at least one customer restriction rule placeholder provided by the partner developed as a partner-defined restriction rule and made available for use by the customer.