Access control mechanism for shareable interface communication access control

An apparatus, comprising:

• one or more processors;
• and a machine readable non-transitory medium comprising instructions for causing the one or more processors to:
• execute a first application from a first bundle of applications to obtain a first application instance in a first execution context, wherein the first application instance comprises a first protected resource in a shareable interface object (SIO), wherein the first execution context is isolated by a firewall from a second execution context, wherein the first execution context is associated with a first protection domain, and wherein the first protection domain specifies the first bundle of applications a first set of instructions, when executed giving rise to the first application instance, is packaged with a first application module;
• receive a request from a second application instance executing in the second execution context to access the first protected resource, wherein the second application instance is obtained by executing a second application from a second bundle of applications, wherein the second execution context is associated with a second protection domain, wherein the second protection domain specifies a second bundle of applications subject to a first domain security policy, wherein the first domain security policy comprises a first list of protection domains, and wherein the first domain security policy permits an application from the second bundle of applications to access a protected resource of another protection domain when the another protection domain is specified in the first list of protection domains in a shareable interface object (SIO) in the first application instance, wherein a second set of instructions, when executed giving rise to the second application instance, is packaged with a second application module;
• make a first determination, based on the request and first domain security policy, that the first protection domain is specified by the first list of protection domains based on the first determination:
• make a second determination, based on the second application and a declarative security policy associated with the first application that the second application is authorized to access the first protected resource;
• and based on the first determination and the second determination:
• grant the second application access to the first protected resource.