Access control technique for resolving grants to users and groups of users on objects and groups of objects

摘要

Various embodiments of a method, system and article of manufacture resolve access to a specific principal on a particular resource. A set of candidate access rights to at least one principal on at least one resource is determined based on at least one grant. Any candidate access right for which there is another candidate access right to a same principal on a resource which is closer to the particular resource along a same route is eliminated from the said set of candidate access rights. Any candidate access right for which there is another candidate access right on a same resource to a principal which is closer to the specific principal along a same route is eliminated from the set of candidate access rights. Access is provided in accordance with a most permissive access level of the set of candidate access rights.