Specification of a hierarchical authorization model for a DBMS—SQL language extensions

A database management system that facilitates providing permission to entities of a database, comprising:

• a processor operatively coupled to a computer readable medium having stored thereon the following computer executable components:
• a component for authorizing a principal of a containing entity of a database to dynamically grant a permission to that entity by providing extended syntax grammar of a database query language that accommodates a hierarchical permissions model;
• a component for dynamically granting the permission to the containing entity, the grantee of the permission inherits a set of permissions to one or more entities contained by the containing entity;
• a component for performing a two-step authentication and authorization handshake for a grantee to transfer permission for an entity to a principal without a repudiation issue by authenticating a principal with an entity, receiving a call from the principal to relinquish ownership of the entity, and determining if a call to accept ownership of the entity is received from a potential owner, wherein the two-step authentication and authorization component is further for performing two-step handshakes to effect permissions for administrators who can claim ownership of the securable entity, owners who take ownership of any entity that they create, and users who are granted permission by the owners to perform operations on the entity that they own, and wherein the granting component holds a lock for a short period while performing the grant by computing dynamically a permission on a lower scope schema or table rather than explicitly materializing such that there is one physically persisted permission that covers a current sub-entity and a future sub-entity contained on the lower scopes;
• and
• a component for creating a schema with a securable entity for which permissions can be granted, revoked, or denied, and with a grantable take ownership permission without regard to whether a particular user desires ownership.