Data authorization evaluation framework

A method, implemented in a computing system comprising at least one hardware processor and at least one memory coupled to the at least one hardware processor, the method comprising:

• receiving user input defining data access restrictions for a first computing object that comprises data or is useable to retrieve data from one or more other computing objects;
• storing data defining the data access restrictions in a first plurality of computing objects, computing objects of the first plurality of computing objects having respective schemas defining respective pluralities of attributes for storing data in an instance of their respective schemas;
• copying values for less than all of the plurality of attributes for a second plurality of the first plurality of computing objects into one or more computing objects of a data access authorization schema, the second plurality of the first plurality of computing objects being less than all of the first plurality of computing objects;
• receiving a first data access authorization analysis request, the first data access authorization analysis request comprising, or comprising information sufficient to identify, a user identifier or a user group identifier, and an identifier of at least the first computing object;
• retrieving data from at least a portion of the one or more computing objects to provide retrieved data;
• and
• returning the retrieved data in response to the first data access authorization analysis request or evaluating the retrieved data to determine a first data access authorization result and returning the first data access authorization result in response to the first data access authorization analysis request.

One or more computer-readable storage media comprising:

• computer-executable instructions that, when executed by a computing system comprising at least one hardware processor and at least one memory coupled to the at least one hardware processor, cause the computing system to receive user input defining data access restrictions for a first computing object that comprises data or is useable to retrieve data from one or more other computing objects;
• computer-executable instructions that, when executed by the computing system, cause the computing system to store data defining the data access restrictions in a first plurality of computing objects, computing objects of the first plurality of computing objects having respective schemas defining respective pluralities of attributes for storing data in an instance of their respective schemas;
• computer-executable instructions that, when executed by the computing system, cause the computing system to copy values for less than all of the plurality of attributes for a second plurality of the first plurality of computing objects into one or more computing objects of a data access authorization schema, the second plurality of the first plurality of computing objects being less than all of the first plurality of computing objects;
• computer-executable instructions that, when executed by the computing system, cause the computing system to receive a first data access authorization analysis request, the first data access authorization analysis request comprising, or comprising information sufficient to identify, a user identifier or a user group identifier, and an identifier of at least the first computing object;
• computer-executable instructions that, when executed by the computing system, cause the computing system to retrieve data from at least a portion of the one or more computing objects to provide retrieved data;
• and
• computer-executable instructions that, when executed by the computing system, cause the computing system to return the retrieved data in response to the first data access authorization analysis request, or to evaluate the retrieved data to determine a first data access authorization result, wherein the first data access authorization result is then returned in response to the first data access authorization analysis request.