Data flow-oriented access control

A system comprising:

• at least one programmable processor;
• and
• a non-transitory machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
• generating, by a first service on a first application stack, a first service request to invoke a second service, the first service having a first access context associated therewith that defines authorization checks related to functions performed by and data processed by the first service;
• transmitting the first service request to invoke the second service from the first service to an access control service, the first service request being transmitted with the first access context of the first service;
• receiving, from the access control service, a second access context, the second access context defining authorization checks relevant to functions and data processing to be performed by the second service to fulfill the first service request;
• and
• transmitting the first service request in combination with the second access context to the second service, the second service enabled to execute the first service request using authorization checks defined in the second access context.

A non-transitory, computer readable medium storing instructions, which when executed by at least one processor cause a computer to perform a method comprising:

• generating, by a first service on a first application stack, a first service request to invoke a second service, the first service having a first access context associated therewith that defines authorization checks related to functions performed by and data processed by the first service;
• transmitting the first service request to invoke the second service from the first service to an access control service, the first service request being transmitted with the first access context of the first service;
• receiving, from the access control service, a second access context, the second access context defining authorization checks relevant to functions and data processing to be performed by the second service to fulfill the first service request;
• and
• transmitting the first service request in combination with the second access context to the second service, the second service enabled to execute the first service request using authorization checks defined in the second access context.