Dynamic authorization in a multi-tenancy environment via tenant policy profiles

A non-transitory storage medium having stored therein computer-executable instructions which, when executed by one or more hardware processors, manage user access to one or more applications, wherein management of user access comprises:

• creating a set of user characteristics for authorization of a user;
• comparing the user characteristics to application roles included in respective application authorization profiles, the application authorization profiles each corresponding to a different respective application, wherein comparison of user characteristics to application roles is performed dynamically in response to a change in one or both of a user characteristic and an application authorization profile;
• identifying a match between the user characteristics and a plurality of application roles;
• extracting matching application roles and associated respective privilege masks from the application authorization profiles;
• returning the extracted application roles and associated privilege masks;
• placing each extracted application role and associated privilege mask in a respective token;
• and
• returning the tokens to the respective applications to which the plurality of application authorization profiles respectively correspond.