Proactive information security management

A system for controlling access to sensitive information, the system comprising:

• a processor;
• a memory coupled to the processor;
• and
• logic encoded in one or more computer readable media for:
• maintaining access constraint data that can be used to control access to said sensitive information;
• wherein said access constraint data comprises match pattern data and apply pattern data;
• wherein said match pattern data represents a semantic graph pattern expression that identifies one or more basic semantic graphs of a semantic graph of said sensitive information;
• wherein said apply pattern data represents a semantic graph pattern expression to be evaluated against any basic semantic graph of one or more basic semantic graphs before the any basic semantic graph is returned as a query result;
• receiving a semantic query requesting access to said sensitive information;
• wherein said semantic query is capable of being evaluated against a semantic graph of said sensitive information;
• based on said match pattern data, determining whether said semantic query should be constrained according to said apply pattern data;
• responsive to determining that said semantic query should be constrained according to said apply pattern data, rewriting said semantic query according to said apply pattern data to produce a rewritten query;
• executing said rewritten query against a database that contains said sensitive information;
• and
• returning any results of executing said rewritten query.

One or more non-transitory computer-readable media storing instructions which, when executed by one or more computing devices, cause performance of a method comprising:

• maintaining access constraint data that can be used to control access to said sensitive information;
• wherein said access constraint data comprises match pattern data and apply pattern data;
• wherein said match pattern data represents a semantic graph pattern expression that identifies one or more basic semantic graphs of a semantic graph of said sensitive information;
• wherein said apply pattern data represents a semantic graph pattern expression to be evaluated against any basic semantic graph of the one or more basic semantic graphs before the any basic semantic graph is returned as a query result;
• receiving a semantic query requesting access to said sensitive information;
• wherein said semantic query is capable of being evaluated against a semantic graph of said sensitive information;
• based on said match pattern data, determining whether said semantic query should be constrained according to said apply pattern data;
• responsive to determining that said semantic query should be constrained according to said apply pattern data,
• rewriting said semantic query according to said apply pattern data to produce a rewritten query;
• executing said rewritten query against a database that contains said sensitive information;
• and
• returning any results of executing said rewritten query.