Deterministic Enforcement in Data Virtualization Systems

A computer system comprising:

• a hardware processor;
• and
• a data policy service, in communication with the hardware processor, wherein the data policy service is configured:
• responsive to receiving a query, identifying a queried virtual object among a set of connected objects that represents a set of data assets and their hierarchical relationships, wherein the queried virtual object corresponds to a subset of the data assets;
• identifying a subset of objects according to a cumulative transitive closure rooted at the queried virtual object over the set of connected objects;
• identifying a set of policies for the subset of objects;
• for each object in the subset of objects, applying the set of policies to determine an intermediate decision according to the cumulative transitive closure, whereby a set of intermediate decisions is formed;
• deterministically reconciling the set of intermediate decisions to generate a resolved decision;
• and
• providing access to the queried virtual object based on the resolved decision.

A computer program product comprising:

• a computer readable storage media;
• and
• program code, stored on the computer readable storage media, for policy-based enforcement in a data virtualization system, the program code comprising:
• program code for identifying, responsive to receiving a query, a queried virtual object among a set of connected objects that represents a set of data assets and their hierarchical relationships, wherein the queried virtual object corresponds to a subset of the data assets;
• identifying a subset of objects according to a cumulative transitive closure rooted at the queried virtual object over the set of connected objects;
• program code for identifying a set of policies for the subset of objects;
• program code for applying, for each object in the subset of objects, the set of policies to determine an intermediate decision according to the cumulative transitive closure, whereby a set of intermediate decisions is formed;
• program code for deterministically reconciling the set of intermediate decisions to generate a resolved decision;
• and
• program code for providing access to the queried virtual object based on the resolved decision.