Access control in data processing system

A storage device storing computer program code executable by a processor, the computer program code comprising:

• a first computer program part to determine whether a policy data structure defines a predetermined authorization for a resource access request that has been received;
• a second computer program part to, in response to determining that the policy data structure defines the predetermined authorization for the request, apply the predetermined authorization to the request, by the processor, to determine whether to grant the request;
• a third computer program part to, in response to determining that the policy data structure does not define the predetermined authorization for the request, apply a dynamic authorization request condition specified by the policy data structure to the request, by the processor, to determine whether to still grant the request despite the policy data structure not defining the predetermined authorization for the request;
• a fourth computer program part to identify any temporal validity limitation for the set of attributes associated with the resource access request to which the dynamic authorization request condition is applied;
• and
• a fifth computer program part to determine whether to add a dynamic authorization to the policy data structure in accordance with the temporal validity limitation.

A system comprising:

• a plurality of resources;
• an apparatus to control access to the resources, the apparatus comprising:
• a memory to store a policy data structure;
• and,
• control logic to:
• determine whether the policy data structure defines a predetermined authorization for a resource access request that has been received;
• in response to determining that the policy data structure defines the predetermined authorization for the request, apply the predetermined authorization to the request, by the processor, to determine whether to grant the request;
• and
• in response to determining that the policy data structure does not define the predetermined authorization for the request, apply a dynamic authorization request condition specified by the policy data structure to the request, by the processor, to determine whether to still grant the request despite the policy data structure not defining the predetermined authorization for the request,
• wherein the predetermined authorization relates to a plurality of dynamic access requests that each indicate a dynamic authorization request condition to be satisfied by a respective set of attributes associated with a user request to access a resource and for the request to be granted in absence of an authorization determination of the request.