Entitlement security and control for information system entitlement

A system comprising:

• an entitlement security and control unit having:
• a data classification unit to receive and classify data to form entitlement rules and roles;
• a metadata repository coupled with the classification unit, the metadata repository having the entitlement rules and roles and metadata describing the entitlement rules and roles;
• and
• an entitlement processing unit coupled with the metadata repository, the entitlement processing unit to
• process an entitlement request received from a downstream access control system seeking an entitlement permission to an upstream protected application by searching data relating to the downstream access control system and to a user associated with the request to provide details of the data in a customized format, wherein the searching of the data is performed in real-time via a search engine,
• retrieve the data, and match the data with request information contained in the request, and match the request information with the entitlement rules and roles and the metadata,
• grant the entitlement permission upon satisfaction of the entitlement rules and roles by the entitlement request, generate an audit trail of entitlement events by keeping track of the entitlement events relating to the granting of the entitlement permission, the audit trail having entitlement-related information, the tracking of the entitlement events including identifying missing information, the missing information is verified against the entitlement-related information being stored at a database,
• validate the granting of the entitlement request by accessing the audit trail, wherein the audit trail is further to perform one or more of track history of the user, identify the user, track updates to status of the user, and validate access-related information, and track and
• maintain data sources in real-time via an event tracker, wherein the data sources include the database,
• reject the entitlement permission upon dissatisfaction of the entitlement rules and roles by the entitlement request, and
• granting an exception to the downstream access control system, the exception comprises the downstream access control system submitting a second entitlement request to seek entitlement permission.

A tangible computer-readable storage medium comprising computer program which, when executed, cause a computer to:

• receive an entitlement request from a downstream access control system seeking an entitlement permission;
• search data relating to the downstream access control system and to a user associated with the request to provide details of the data in a customized format, wherein the searching of the data is performed in real-time via a search engine, retrieving the data, and matching the data with request information contained in the request;
• retrieve entitlement rules and roles from a metadata repository, the metadata repository includes metadata describing the entitlement rules and roles;
• match the request information with the entitlement rules and roles and the metadata;
• grant the entitlement permission upon satisfaction of the entitlement rules and roles by the entitlement request;
• generate an audit trail of entitlement events by keeping track of the entitlement events relating to the granting of the entitlement permission, the audit trail having entitlement-related information, the tracking of the entitlement events including identifying missing information, the missing information is verified against the entitlement-related information being stored at a database, wherein the audit trail is further to perform one or more of track history of the user, identify the user, track updates to status of the user, and validate access-related information;
• track and maintain data sources in real-time via an event tracker, wherein the data sources include the database;
• validate the granting of the entitlement request by accessing the audit trail;
• reject the entitlement permission upon dissatisfaction of the entitlement rules and roles by the entitlement request;
• and
• grant an exception to the downstream access control system, the exception comprises the downstream access control system submitting a second entitlement request to seek entitlement permission.