Flexible policy arbitration control suite

A method for controlling access to one or more shared system resources of a computing device by a plurality of peer domains each having a defined use purpose context that is unknown to the other domains, each of the domains executable independently of the other domains and to request access to the one or more shared system resources, the method comprising, with the computing device:

• maintaining, independently of the domains, a set of domain-specific policies governing operation of the computing device, the set of domain-specific policies comprising, for each of the domains, at least one policy implementation that effectuates the defined use context purpose of the domain without conflicting with the defined use purpose context of any of the other domains on the computing device;
• in autonomous response to an event trigger, executing at least one of the policy implementations implicated by the event trigger, wherein the use purpose context is indicative of a personal or non-personal use, wherein a personal use context pertains to at least one domain in which there is a higher need to share information than a domain having a non-personal use context, and wherein the non-personal use context pertains to at least one domain in which there is a higher need to protect information than a domain having the personal use context domain;
• and
• for each of the domains, selecting a least restrictive policy implementation from a plurality of candidate policy implementations, wherein the least restrictive policy implementation effectuates the defined purpose of the domain in a least restrictive way without conflicting with the defined purpose of any of the other domains on the computing device, and executing the selected policy implementation in response to the event trigger,
• wherein a policy arbitration system is executable to determine and enforce the least-restrictive combination of the domain-specific policies dynamically in response to an event trigger.

A policy arbitration system for a computing device for use with multiple user-level execution environments wherein the environments are isolated from one another to simultaneously protect personal privacy and enterprise security while enabling data sharing, wherein the computing device is configured with a plurality of domains that are independently executable on the computing device to request access to one or more shared system resources of the computing device, the policy arbitration system comprising:

• one or more processors;
• and
• a non-transitory computer-readable medium comprising a plurality of instructions executable by one or more processors to:
• analyze a set of candidate policy implementations, each of the candidate policy implementations being associated with one of the plurality of domains and executable to effectuate a defined purpose of the associated domain, the defined purpose specifying a permitted use purpose context of one or more shared system resources of the computing device;
• select, from the set of candidate policy implementations, a least restrictive candidate policy implementation that does not conflict with any of the defined purposes of the domains;
• and
• compile and autonomously enforce the selected policy implementation to govern the operation of the computing device across all of the domains, including to control access to the one or more shared system resources of the computing device if the policy implementation is implicated by an event trigger;
• wherein the use purpose context is indicative of a personal or non-personal use, wherein a personal use context pertains to at least one unclassified domain a non-personal use context pertains to at least one classified domain.