Deriving and using data access control information to determine whether to permit derivations of data elements

A system in communication with a data store having a plurality of elements and at least one user system, comprising:

• a processor;
• and
• a computer readable storage medium including code capable of being executed by the processor to perform operations comprising:
• initializing data access control information associated with each of a plurality of data elements in the data store, wherein the data access control information associated with each of the data elements includes a user access list indicating authorized users and different access levels for authorized users, and a data access list indicating at least one data element other than the data element associated with the data access control information that may be involved in a derivation with the data element associated with the data access control information including the data access list to form a derived data element;
• receiving a derivation request from one user to subject a first and second data elements of the data elements to a derivation operation to form the derived data element, wherein the derivation comprises aggregating or combining data elements;
• processing the data access control information associated with of the first and second data elements to determine whether the user access list and the data access list in the processed data access control information permit the user to derive the derived data element from the first and second data elements by performing:
• determining from the data access control information for one of the first and second data elements whether the user is indicated on the user access list of the data access control information and the access level of the user when indicated in the user access list;
• and
• determining whether the access level of the user permits the user to perform the requested derivation on the first and second data elements, wherein different access levels for different users permit different derivations of data elements indicated in the data access list;
• and
• processing, by the derivation operation, the first and second data elements to produce the derived data element comprising data based on the processed first and second data elements in response to determining that the user access list and the data access list permit the user to derive the derived data element from the first and second data elements.

An article of manufacture comprising at least one of a hardware device and a computer readable storage medium having code for communicating with a data store having data elements, wherein the code is enabled to cause operations to be performed, the operations comprising:

• initializing data access control information associated with each of a plurality of data elements, wherein the data access control information associated with each of the data elements includes a user access list indicating authorized users and different access levels for authorized users, and a data access list indicating at least one data element other than the data element associated with the data access control information that may be involved in a derivation with the data element associated with the data access control information including the data access list to form a derived data element;
• receiving a derivation request from one user to subject a first and second data elements of the data elements to a derivation operation to form the derived data element, wherein the derivation comprises aggregating or combining data elements;
• processing the data access control information associated with the first and second data elements to determine whether the user access list and the data access list in the processed data access control information permit the user to derive the derived data element from the first and second data elements by performing:
• determining from the data access control information for one of the first and second data elements whether the user is indicated on the user access list of the data access control information and the access level of the user when indicated in the user access list;
• and
• determining whether the access level of the user permits the user to perform the requested derivation on the first and second data elements, wherein different access levels for different users permit different derivations of data elements indicated in the data access list;
• and
• processing, by the derivation operation, the first and second data elements to produce the derived data element comprising data based on the processed first and second data elements in response to determining that the user access list and the data access list permits the user to derive the derived data element from the first and second data elements.