Permission verification method and system applied to OA examination and approval

Abstract

The invention discloses a permission verification method and system applied to OA examination and approval, and relates to the technical field of permission verification, and the method comprises the steps: receiving an examination and approval request triggered by an OA system, carrying out the extraction according to the examination and approval request, and obtaining user identity information and an examination and approval content label set; triggering a multi-level permission verification mechanism based on the user identity information, and generating a dynamic verification rule set; performing permission verification on the approval content label according to the dynamic verification rule set, and formulating a target verification rule; and executing the target verification rule to perform multi-level cross verification on the user permission, generating a permission verification report according to a verification result, and feeding back the permission verification report to the OA system to trigger a subsequent approval process. The technical problems of low approval process efficiency and inaccurate authority control caused by fixed static rule configuration in the authority verification process in the prior art are solved, and the technical effects of improving the authority verification flexibility and accuracy and enhancing the approval process safety and intelligent level are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of authority verification, and in particular to an authority verification method and system applied to OA approval. Background Art

[0002] With the continuous improvement of enterprise informatization, office automation systems have been widely used in scenarios such as daily administrative management, business process approval, and authority control. In actual use, OA systems need to verify the permissions of initiated approval requests to ensure that users have the corresponding approval permissions, thereby ensuring the standardization and security of enterprise processes.

[0003] In existing OA systems, permission verification mechanisms are typically based on pre-set static rules. For example, permissions are determined based on the user's department, position, or role, and approval processes are executed according to fixed templates. This static configuration approach provides a certain degree of controllability in the early stages of system deployment. However, as business processes continue to expand, organizational structures adjust, and approval content evolves, static rules become difficult to respond to the permission determination requirements required in complex approval scenarios in real time. Summary of the Invention

[0004] This application provides a permission verification method and system for OA approval, which is used to solve the technical problem in the existing technology that the static rule configuration of the permission verification process is fixed, resulting in low approval process efficiency and inaccurate permission control.

[0005] In view of the above problems, this application provides an authority verification method and system for OA approval.

[0006] In a first aspect of the present application, a permission verification method for OA approval is provided, the method comprising: Receive the approval request triggered by the OA system, extract according to the approval request, obtain user identity information and approval content tag set; trigger the multi-level permission verification mechanism based on the user identity information, and generate a dynamic verification rule set; perform permission verification on the approval content tag according to the dynamic verification rule set, and formulate target verification rules; execute the target verification rules to perform multi-level cross-verification on user permissions, generate a permission verification report based on the verification results, and feed the permission verification report back to the OA system to trigger the subsequent approval process.

[0007] The second aspect of the present application provides an authority verification system for OA approval, the system comprising: An approval request receiving module is used to receive an approval request triggered by the OA system, extract the user identity information and the approval content tag set based on the approval request; a verification rule generating module is used to trigger a multi-level authority verification mechanism based on the user identity information and generate a dynamic verification rule set; an authority verification module is used to perform authority verification on the approval content tag according to the dynamic verification rule set and formulate target verification rules; an authority verification report generating module is used to execute the target verification rules to perform multi-level cross-verification on user authority, generate an authority verification report based on the verification results, and feed the authority verification report back to the OA system to trigger a subsequent approval process.

[0008] One or more technical solutions provided in this application have at least the following technical effects or advantages: This application receives an approval request triggered by an OA system, extracts information based on the approval request, obtains user identity information and a set of approval content labels; triggers a multi-level permission verification mechanism based on the user identity information, and generates a set of dynamic verification rules; performs permission verification on the approval content labels according to the dynamic verification rule set, and formulates target verification rules; executes the target verification rules to perform multi-level cross-verification on user permissions, generates a permission verification report based on the verification results, and feeds the permission verification report back to the OA system to trigger a subsequent approval process. The present invention solves the technical problem in the prior art that static rule configuration of the permission verification process is fixed, resulting in low efficiency of the approval process and inaccurate permission control. By introducing a dynamic verification rule generation mechanism, semantic label parsing and context dependency modeling, multi-level cross-verification and other means, the technical effect of improving the flexibility and accuracy of permission verification, and enhancing the security and intelligence level of the approval process is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A flowchart of the permission verification method for OA approval provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of the authority verification system applied to OA approval provided in an embodiment of the present application.

[0011] Description of reference numerals: approval request receiving module 11 , verification rule generating module 12 , authority verification module 13 , authority verification report generating module 14 . DETAILED DESCRIPTION

[0012] This application provides a permission verification method and system for OA approval, aiming to solve the technical problem in the existing technology that the static rule configuration of the permission verification process is fixed, resulting in low approval process efficiency and inaccurate permission control. By introducing dynamic verification rule generation mechanism, semantic label parsing and context dependency modeling, multi-level cross-validation and other means, the application achieves the technical effect of improving the flexibility and accuracy of permission verification and enhancing the security and intelligence level of the approval process.

[0013] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0014] It should be noted that any variations of the terms "include" and "have" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or are inherent to these processes, methods, products or devices.

[0015] Example 1, as Figure 1 As shown, this application provides a permission verification method applied to OA approval, the method comprising: Step S100: receiving an approval request triggered by the OA system, performing extraction according to the approval request, and obtaining user identity information and an approval content tag set.

[0016] In an embodiment of the present application, an approval request triggered by an OA system is received, and the request content is deeply parsed and extracted. Specifically, the encrypted approval request stream from the OA system is first received through the API gateway, and the request stream is parsed to obtain a structured request message. Subsequently, user identity information and approval content data are extracted from the structured message, wherein the user identity information includes a request header field and request body data. The user identity is verified based on the request header field. After the identity verification is passed, the approval content in the request body is further semantically segmented, key semantic information is extracted, and an approval content tag set is formed. Through this process, the automatic extraction and structured processing of identity and content information in the approval request is achieved.

[0017] Furthermore, in the method provided in the embodiment of the application, receiving an approval request triggered by the OA system, extracting according to the approval request, obtaining user identity information and an approval content tag set, further includes: The encrypted approval request stream received by the OA system is obtained through the API gateway, and the encrypted approval request stream is parsed to obtain a structured request message; user identity information is extracted from the structured request message, and the user identity information includes a request header field and request body data; user identity verification is performed based on the request header field, and when the identity verification passes, the request body data is semantically segmented to generate the approval content tag set.

[0018] In this embodiment of the present application, an encrypted approval request stream from the OA system is first received through the API gateway. The TLS protocol is used to ensure the security of the transmission process and prevent data from being intercepted or tampered with during transmission. After receiving the encrypted request, the AES algorithm is used to decrypt the data to obtain the original plaintext request content. Subsequently, the plaintext request is structured using the JSON format parsing method, and finally a structured request message with a standardized format and clear fields is obtained.

[0019] After obtaining the structured request message, we use a field path extraction method to extract key data, including user identity information and approval content. This user identity information includes the user identifier, request timestamp, and digital signature extracted from the request header, as well as the approval content text, attachment hash value, and approval process code extracted from the request body. This extraction process yields complete user identity information, which is composed of both the request header fields and the request body data.

[0020] After completing the data extraction of the structured request message, the request header field is first parsed to extract the user identity identifier, and the identity identifier is verified in multiple dimensions by accessing the distributed identity authentication service. The verification process includes user legitimacy verification, permission validity confirmation, and signature consistency comparison, and finally generates an identity verification result. If the identity verification passes, continue to process the request body data, apply the semantic segmentation method to the approval content text, and extract key business information, including key entity labels, approval type labels, and approval content risk level labels. Subsequently, based on the approval content risk level label, the extracted key entity labels and approval type labels are structured and matched, and the relationship between them in the business scenario is combined with the construction logic to complete the generation of the approval content label set.

[0021] Furthermore, in the method provided in the embodiment of the application, user identity verification is performed based on the request header field. When the identity verification passes, semantic segmentation is performed on the request body data to generate the approval content label set, which also includes: Parse the request header field, extract the user identity identifier, perform multi-dimensional verification on the user identity identifier through a distributed identity authentication service, and generate an identity verification result; when the identity verification result is that the identity verification passes, perform semantic segmentation on the approval content text in the request body data, and extract key entity tags, approval type tags, and approval content risk level tags; according to the approval content risk level tags, perform structured association matching on the key entity tags and the approval type tags to generate the approval content tag set.

[0022] In an embodiment of the present application, an approval request data packet sent by the OA system is first received, and the request header fields in the data packet are parsed. This parsing process uses a standard JSON field extraction method, utilizing a key-value pair structure to directly locate and extract the user identity identifier through a preset field path. This identity identifier is typically an encrypted token or a Base64-encoded string. During extraction, format verification is performed to ensure that the field meets the preset length and character set requirements. Through this step, the user identity identifier is obtained, providing input for subsequent verification.

[0023] The extracted user identity identifier is then submitted to the distributed identity authentication service, and identity verification is performed in three dimensions in sequence. The first step is to verify the legitimacy of the organization using the organizational mapping table. Using the user ID corresponding to the identity identifier, the local organizational structure table is used to check whether the department to which it belongs is within the scope of the permission definition. If there is no matching record, it is judged as an illegal request. The second step is to verify the timeliness of the user permission. By reading the permission effective time and expiration time fields in the permission record database and comparing them with the current system time, it is determined whether the user permission is still valid. The third step is to verify the digital signature. Using the RSA signature verification method, the digital signature field in the request header is decrypted using the public key stored by the server. At the same time, the SHA256 algorithm is used to generate a local summary of the request content, and it is compared with the decryption result to determine whether the data has been tampered with during transmission. Through these three operations, the identity verification result is generated.

[0024] If the identity verification passes, the approval content in the request body is processed. This text is typically a business description in natural language format, such as "Request for purchase of equipment XX, budgeted at 200,000 yuan." To extract semantic information with business significance, a rule-based word segmentation method is first used to segment the text into phrases, identifying common keywords and semantic units. Using a pre-set keyword dictionary and entity templates, a string matching algorithm (such as the KMP algorithm) is used to traverse and parse the approval content, accurately extracting key entity information such as equipment name, amount, and project number, and generating key entity labels. Subsequently, by examining the contextual structure of the keywords, the rule base identifies the business type of the approval. For example, "procurement" and "reimbursement" are identified as corresponding approval types, generating an approval type label. Furthermore, based on the presence of sensitive terms, amount ranges, and document descriptions in the approval content, risk assessment rules are applied to categorize the potential risk of the approval request, generating a risk level label for the approval content, such as "low risk," "medium risk," or "high risk."

[0025] After obtaining the key entity tags, approval type tags, and risk level tags, a structured matching operation is performed based on the business relationships between the tags. This stage applies the corresponding matching rules according to the matching template indicated by the risk level tag. For example, for high risk levels, the key entity tags and approval type tags must fully comply with the field requirements in the high-security template to ensure strict implementation of the approval process. For low risk levels, the matching conditions can be moderately relaxed regarding the tag content. Through structured tag combination and verification, a set of approval content tags is ultimately generated.

[0026] Step S200: triggering a multi-level authority verification mechanism based on the user identity information and generating a dynamic verification rule set.

[0027] In an embodiment of the present application, by parsing user identity information, extracting user identity attributes related to permissions, and based on this, determining the user role level, and then dividing multiple permission verification levels. Combined with the approval content tag set, the user permission level is matched with the approval requirements. When the role level and the permission required for approval are at the same level, a serial verification condition is generated; when there is a cross-layer permission situation, a parallel verification condition is generated. Finally, based on the risk level of the approval content, the serial and parallel verification conditions are dynamically combined to generate a dynamic verification rule set that is compatible with the current approval request.

[0028] Furthermore, in the method provided in the embodiment of the application, a multi-level permission verification mechanism is triggered based on the user identity information to generate a dynamic verification rule set, and the method further includes: Parse the user identity information to obtain user identity attribute information; extract the user role level based on the user identity attribute information, and divide the multiple verification levels according to the user role level; match the approval content label set with the multiple verification levels, and when the matching result is the same verification level, obtain a serial verification condition; when the matching result is different verification levels, obtain a parallel verification condition; dynamically combine the approval content risk level label with the serial verification condition and the parallel verification condition to generate the dynamic verification rule set.

[0029] In the embodiment of the present application, when generating a dynamic validation rule set based on user identity information, a field mapping method is first used to parse the received user identity information. This method uses preset field correspondences to extract field information such as "department number," "job title," and "rank code" from the user identity data and uses this information as user identity attribute information. These attribute fields are the direct basis for subsequently determining the user's permission level and are typically sourced from the enterprise permission configuration database or employee master data table.

[0030] Next, a table lookup and matching method is used to parse the position code in the user's identity attributes. By searching the permission level comparison table for the role level corresponding to the position code, such as "employee," "department head," or "deputy general manager in charge," the user's role within the approval permission system is clearly defined. This process ensures that each user category is clearly categorized within the permission structure, providing an accurate basis for the division of permission hierarchies.

[0031] After role level identification is complete, a hierarchical classification method is used to map the user's role level to a predefined verification hierarchy. This hierarchy is typically divided into three categories: primary, intermediate, and advanced verification rules, corresponding to basic operational permissions, department-level approval permissions, and high-risk or cross-departmental approval permissions. For example, ordinary employees are classified into the primary verification level, department heads into the intermediate level, and senior executives into the advanced verification level.

[0032] Subsequently, a rule matching method is used to compare the approval type labels and key entity labels in the approval content label set with the above-mentioned verification levels one by one. The comparison standard is based on the permission correspondence configuration table between the approval type and the role level to determine whether the verification level required for the current approval content is consistent with the verification level to which the user currently belongs. If the two are consistent, it means that the user can complete the approval within the scope of authority at this level, and it is marked as a serial verification condition. If any verification fails in the serial verification, it is deemed that all verifications under the serial verification condition are not passed; if the permission requirements involved in the approval content are higher than the current level of the user, for example, an ordinary employee initiates a request for approval authority at the middle level or above, it is marked as a parallel verification condition, indicating that users at other permission levels need to be introduced for collaborative approval at the same time. If the highest level verification in the parallel verification fails, it is deemed that the verification under the parallel verification condition is not passed.

[0033] Based on the acquired serial and parallel validation conditions, the validation conditions are dynamically combined based on the risk level label of the approval content. This process first calls the validation rule template library based on the risk level label to match the applicable serial and parallel validation structure. Secondly, context analysis is performed based on the approval type label to identify its correlation with historical approval scenarios. The serial validation conditions are sorted based on this correlation to form a serial validation priority sequence. Finally, the dynamic rule engine logically combines the sorted serial validation conditions with the parallel validation conditions to construct a dynamic validation rule set that conforms to the approval semantics and risk level.

[0034] Furthermore, in the method provided in the embodiment of the application, the dynamic verification rule set is generated by dynamically combining the approval content risk level label with the serial verification condition and the parallel verification condition, and further includes: The verification rule template library is called according to the approval content risk level label, and the serial verification conditions and the parallel verification conditions are retrieved and matched based on the verification rule template library; context analysis is performed based on the approval type label to determine the context relevance, and the serial verification conditions are verified and sorted according to the context relevance to determine the serial verification priority sequence; the serial verification conditions are logically combined with the parallel verification conditions according to the serial verification priority sequence through the dynamic rule engine to generate the dynamic verification rule set.

[0035] In an embodiment of the present application, in the process of generating a dynamic verification rule set based on the risk level label of the approval content, the risk level label field in the approval content is first read through the label field identification method to determine whether its value is "low risk", "medium risk" or "high risk". After identification, a mapping retrieval method is used to search for a template set corresponding to the risk level in the preset verification rule template library. A mapping relationship between risk level and verification strength has been established in the template library. Low risk corresponds to a single serial verification condition and a basic parallel condition, medium risk corresponds to a dual serial verification chain and an enhanced parallel structure, and high risk corresponds to a full-link serial verification and a multi-dimensional parallel structure. Through mapping index retrieval, the verification condition set that matches the current risk level is extracted to provide a basis for the next step of combination construction.

[0036] Then, context analysis is performed based on the approval type label. By retrieving information from multiple historical business scenarios in the OA system, semantic association analysis is performed between the current approval type label and these scenarios to construct a business knowledge graph. Relying on this graph, the context similarities between the current approval request and the historical approval process are annotated to generate a context correlation scoring matrix. Subsequently, based on this scoring matrix, the dependency relationships between each serial verification condition are traversed to determine the execution order of the verification steps in different contexts. Finally, the serial verification conditions are sorted using a topological sorting method to generate a structured serial verification priority sequence.

[0037] After the sorting is complete, the rule engine modeling method is called to perform a unified logical combination of the serial verification priority sequence and the parallel verification conditions. The combination logic consists of two parts: one is to establish dependencies based on the verification order, and organize the execution process of the serial nodes in sequence; the other is to configure a status monitor for each serial verification node to monitor the execution status. When the monitor detects that the node verification has timed out or failed, it automatically triggers the rule engine to perform preset operations. The operation includes short-circuiting jumps to subsequent unexecuted nodes, immediately ending the current path, or activating the corresponding backup parallel verification branch and rebuilding the temporary path to ensure that the approval process is not interrupted.

[0038] To ensure proper resource allocation for parallel verification paths, we use concurrency control and scheduling algorithms to manage the number of threads executing in parallel. Specifically, we set a maximum concurrency threshold. When the number of parallel tasks exceeds this threshold, a priority-based queue scheduling mechanism is triggered, placing the remaining verification tasks into the scheduling queue and executing them in batches based on priority.

[0039] Through the above method, the whole process from template calling, context sorting to logical combination and scheduling is completed, and finally a set of dynamic verification rules with complete structure, responsiveness to risk level changes, and dynamic behavior adjustment capabilities are generated, providing a refined and controllable decision-making basis for the authority verification of the OA system.

[0040] Furthermore, in the method provided in the embodiment of the application, context analysis is performed based on the approval type label to determine the context relevance, the serial verification conditions are verified and sorted according to the context relevance, and the serial verification priority sequence is determined, which also includes: Retrieve multiple business scenario information of OA approval, and construct a business knowledge graph based on the approval type label and the multiple business scenario information; mark the contextual correlation between approval requests and historical approval cases through the business knowledge graph to generate a correlation scoring matrix; traverse the series verification conditions according to the correlation scoring matrix to determine the context dependency; topologically sort the series verification conditions based on the context dependency to generate the series verification priority sequence.

[0041] In an embodiment of the present application, in the process of constructing a serial verification priority sequence, a label semantic matching method is first used to retrieve information on multiple OA approval business scenarios. By extracting the approval type label in the current approval request and matching it with the process name, node description and other fields in the historical approval process data for keywords, a string similarity comparison algorithm is used to identify historical approval process nodes that are semantically similar to the current request. This step establishes a preliminary semantic correspondence between the current approval request and the historical business process, obtains a set of business process nodes that are highly relevant to the current approval type, and provides a semantic data foundation for subsequent graph construction.

[0042] Next, we used graph database modeling methods to structure the business process information and construct a business knowledge graph. Each approval step in the historical approval process was modeled as a "node" in the graph, and the execution sequence between nodes was modeled as "directed edges." Each node was assigned attributes such as role information, label characteristics, and common fields. This graph modeling not only preserves the structural logic of the approval process but also integrates semantic information related to the nodes, forming a business knowledge graph that can be used for semantic analysis and structural computation.

[0043] After the graph is constructed, a graph similarity calculation method is used to compare the current approval request with each historical process path in the graph. This process evaluates the score based on two dimensions: semantic label similarity. This process extracts the label set (such as approval type label and key field label) from the current approval request and compares it with the label set of each node in the historical process path. This is calculated using a simplified Jaccard similarity coefficient: label similarity = |A∩B| ÷ |A∪B|, where A is the label set of the current approval request and B is the label set of the historical process path. The output similarity is a dimensionless proportional score between 0 and 1. The second dimension is path structure overlap. This process compares the expected node execution order in the current request with the node sequence in the historical process path, calculating the degree of consistency in node order and generating a structural similarity score. The semantic label similarity and structural similarity are weighted and combined according to a set ratio (e.g., 70% semantic + 30% structural) to obtain a contextual relevance score between the current approval request and each historical process path. By comparing all paths, we generate a relevance scoring matrix, where rows represent the current approval request, columns represent historical verification nodes, and cell values ​​indicate the degree of contextual match between that node and the current request. Ultimately, we obtain a two-dimensional scoring matrix with unified units and standardized dimensions. Rows represent approval requests, columns represent historical process nodes, and cell values ​​represent relevance scores, ultimately resulting in a standardized scoring matrix for contextual analysis.

[0044] Based on the correlation scoring matrix, a context dependency extraction method is used to traverse and analyze the set of serial verification conditions. This step is not just a simple identification of high-scoring nodes, but a combination of the scoring matrix and the node connection information in the business knowledge graph to confirm the context dependency between the verification nodes one by one. The specific method is to analyze whether there is a "pre- and post-execution" or "conditional triggering" relationship between high-correlation verification nodes in the historical process path. For example, if node A is executed before node B in multiple historical processes, it is determined that there is a context dependency between A→B. This process integrates semantic associations with process structure analysis, outputs a set of context dependency relationships between verification nodes, and finally obtains a directed dependency graph for sorting.

[0045] After clarifying the context dependencies, a topological sorting structure is constructed. Each serial verification condition is regarded as a node in the graph, and the context dependencies are regarded as directed edges to establish a directed acyclic graph structure. Based on the aforementioned constructed correlation scoring matrix, a weight is assigned to each edge in the graph. The weight value reflects the context strength and historical frequency of occurrence between the connected nodes, and a verification node influence factor matrix is ​​constructed accordingly to measure the weight contribution of each node in the entire approval path. Subsequently, according to the comprehensive weight value of each node in the influence factor matrix, the node with the highest influence factor is selected as the first node of the serial link, that is, the priority execution node. Starting from this first node, the remaining nodes are arranged in descending order based on the upstream and downstream connection relationships and the security weights of the nodes, and nodes with high security levels and clear path dependencies are given priority, and finally a serial verification priority sequence with a clear structure and reasonable order is generated.

[0046] Furthermore, in the method provided in the embodiment of the application, the serial verification conditions are topologically sorted based on the context dependency to generate the serial verification priority sequence, and the method further includes: The serial verification conditions are used as nodes and the context dependencies are used as edges to construct a directed acyclic graph of verification nodes; weights are assigned to the edges of the directed acyclic graph according to the association score matrix, and a verification node influence factor matrix is ​​constructed based on the weight assignment results; the verification node with the highest comprehensive value of the verification node influence factor is selected as the first node of the serial link; based on the first node of the serial link, the remaining nodes of the serial link are arranged in descending order according to the security weight to generate the serial verification priority sequence.

[0047] In an embodiment of the present application, in the process of generating a serial verification priority sequence, a graph structure modeling method is first adopted to set the serial verification conditions one by one as nodes in the graph, and use the context dependencies determined in advance as directed edges between the nodes to construct a directed acyclic graph of the verification nodes. For example, in a typical approval process, if "department head approval" depends on "employee submission", a directed edge from "employee submission" to "department head approval" is constructed in the graph to represent the execution order in the process. Through this method, all verification nodes and their context dependencies are uniformly modeled into a graph with a clear topological structure, and finally a directed acyclic graph for expressing the order and dependency structure of the verification links is obtained.

[0048] After the directed acyclic graph is constructed, a piecewise weight mapping method is used to assign weights to each edge in the graph. Specifically, based on the relevance score matrix, the relevance score value range of 0 to 1 is divided into 10 weight level intervals, and each increase of 0.1 is a level increase. For example, if the contextual relevance score between node A and node B is 0.36, it falls in the fourth interval (i.e., 0.3 to 0.4), and the corresponding edge is assigned a weight level of 4. This weight is used to quantify the dependency strength between nodes. The higher the weight, the closer the contextual connection between the two nodes and the more stable the execution order. Through this process, weights are assigned to all edges in the graph, and the final result is a weighted directed acyclic graph with quantified dependency strength.

[0049] Based on the constructed weighted graph, a multi-factor normalization analysis method was further used to construct a validation node impact factor matrix. Taking each validation node as the analysis unit, metrics were extracted from three dimensions: verification time, security weight, and resource utilization. For the "Department Head Approval" node, for example, verification time can be determined from historical approval logs, e.g., an average processing time of 45 seconds. Security weights are set based on the risk level of the approval content; for example, nodes with amounts exceeding 1 million are assigned a weight of 9. Resource utilization is obtained from system performance monitoring tools, e.g., a node's peak CPU usage when calling external interfaces and validation libraries reaches 65%. After performing min-max normalization on these three dimensions, the data is weighted according to pre-set weights (e.g., 30% for time, 50% for security weight, and 20% for resource utilization) to form a composite impact factor value. This method yields a validation node impact factor matrix that reflects the combined impact of each node on efficiency and security within the process.

[0050] Based on this impact factor matrix, a greedy selection method is used to select the node with the highest combined impact factor value from all verified nodes as the starting node of the series chain. This method traverses the comprehensive score of each node and prioritizes the nodes that are most critical to the current process and have the greatest execution value, without considering the global path. For example, if the "Financial Approval" node has a weighted combined value of 0.91 across all three dimensions, the highest among all nodes, it is selected as the starting node of the series chain. The resulting node is the first executed key node in the series chain, which serves as the initial reference point for subsequent sorting.

[0051] After determining the first node, the priority sorting method is used to sort the remaining verification nodes in the serial chain. The sorting criteria is based on the security weight field. The security weight value of each node is extracted from the impact factor matrix and arranged in descending order. While maintaining the constraints of the original context dependency structure, nodes with high security weights are arranged at the top of the priority list. For example, among the remaining nodes, if the security weight of the "Legal Review" node is 0.87 and the security weight of the "Human Resources Approval" node is 0.72, the "Legal Review" node will be prioritized. Through this sorting process, a serial verification priority sequence is ultimately obtained that satisfies dependency logic, risk control, and execution efficiency.

[0052] Step S300: performing authority verification on the approval content tag according to the dynamic verification rule set, and formulating target verification rules.

[0053] In an embodiment of the present application, in the process of performing permission verification on the approval content label and formulating target verification rules, the conditional screening method is first used to screen out the verification path related to the current approval request from the dynamic verification rule set. Specifically, according to the approval type label and risk level label contained in the approval content label, the rule entries in the dynamic verification rule set are compared in turn to screen out the rule paths with consistent approval types and consistent risk levels. For example, if the approval type is "procurement approval" and the risk level is "medium", then the verification rules that have both the "procurement approval" type condition and the "medium level" risk path are screened out. This step results in a set of candidate verification paths that match the current approval context.

[0054] Then, a field matching method is used to compare the approval content labels with the rule conditions in the permission verification policy library item by item. The permission verification policy library consists of multiple permission rules, each of which sets the permission requirements for specific approval situations, including information such as approval type, amount range, contract category, and participating roles. For example, a certain policy stipulates: "In procurement approval, requests with an amount exceeding 1 million yuan must be approved by department deputy level personnel or above." During the field matching process, the approval type, amount field, contract level, and other information involved in the label are compared one by one to see if they meet the policy conditions. If they are completely consistent, the policy is considered a successful match.

[0055] When multiple matching policy items exist, a field coverage comparison method is used for priority selection. This method calculates the field coverage between each matching policy and the approval content label, specifically counting how many key fields in the policy are completely identical to the label fields. For example, if one policy covers "Approval Type," "Amount," and "Contract Type," while another policy only covers "Approval Type" and "Amount," the policy with higher field coverage will be selected as the higher-priority candidate. Finally, the policy entry with the most complete field match is used as the target validation rule.

[0056] Step S400: Execute the target verification rules to perform multi-level cross-verification on user permissions, generate a permission verification report based on the verification results, and feed the permission verification report back to the OA system to trigger a subsequent approval process.

[0057] In an embodiment of the present application, in the process of executing the target verification rules, the serial verification conditions are gradually executed according to the serial verification priority sequence through the multi-level verification engine, and the parallel verification thread pool is started to process the parallel verification conditions in real time, the execution results of each verification node are collected, and a multi-dimensional verification result matrix containing multiple roles and verification dimensions is constructed. Subsequently, a weighted score is performed based on the matrix, and the results of each verification path are integrated to generate a permission verification report. Finally, the report is encapsulated as a standardized API response message and pushed to the OA system through an asynchronous message queue to trigger the status update of the subsequent approval process.

[0058] Furthermore, in the method provided in the embodiment of the application, executing the target verification rules to perform multi-level cross-verification on user permissions, generating a permission verification report based on the verification results, and feeding the permission verification report back to the OA system to trigger a subsequent approval process, further comprising: The serial verification conditions are executed according to the serial verification priority sequence through a multi-level verification engine, and a parallel verification thread pool is started to process the parallel verification conditions for real-time collection, and a multi-dimensional verification result matrix is ​​constructed; weighted scoring is performed based on the multi-dimensional verification result matrix to generate a permission verification report; the permission verification report is encapsulated as a standardized API response message, and the standardized API response message is pushed to the OA system through an asynchronous message queue to trigger a status change of the subsequent approval process.

[0059] In an embodiment of the present application, in the process of executing the target verification rules and carrying out authority verification, the serial verification conditions are first executed in sequence according to the serial verification priority sequence through the multi-level verification engine. This process adopts a sequential scheduling method to activate each serial verification node one by one according to the order of priority from high to low. Taking "sponsor confirmation → department head approval → financial person in charge review" as an example, the verification engine sequentially retrieves the authority verification logic of each node, combines user identity, authority level, operation behavior and other information to determine whether the user has the execution qualifications required for the current node, and records the verification results, execution time and status code of each node as a serial path execution status set. This step ensures that each link in the serial path is completed according to priority and the records are clear, providing basic data for subsequent scoring.

[0060] Parallel verification is handled through thread pool scheduling. This process first analyzes the execution of the parallel verification conditions and assesses their concurrency complexity, such as the number of parallel nodes, the strength of business coupling between nodes, and the estimated utilization of call resources. If there are multiple high-load nodes (such as "Legal Approval," "Compliance Review," and "Budget Control Department Review"), the parallel condition complexity is determined to be high. Based on the analysis results, the thread pool size is dynamically adjusted to rationally allocate system resources and create a parallel verification thread pool. Subsequently, each thread instance is traversed, and an environment matching method is used to confirm the required thread execution environment parameters, such as the database connection pool, interface call token, cache context, and other configuration items, ensuring that each thread has an independent and complete execution environment. Once the thread pool is ready, threads are activated according to the configuration, concurrently accessing and processing each parallel verification condition. Simultaneously, real-time data collection is performed to capture each node's pass status, execution time, and exception event information, ultimately forming a structured parallel verification dataset.

[0061] After all serial and parallel verification tasks are completed, the multi-dimensional verification result matrix is ​​constructed. This step utilizes a dimensional modeling approach, with verification nodes as row indexes and four key verification dimensions as column indexes, forming a complete scoring matrix. These four dimensions are role fit, data integrity, risk sensitivity, and timeliness compliance. Taking the "Finance Manager Approval" node as an example, this step verifies whether the approver's role matches the established rules (role fit), whether the approval fields are complete (data integrity), whether large payments or high-risk fields are included (risk sensitivity), and whether the approval is completed within the specified timeframe (timeliness compliance). All raw data is converted into standardized scores (ranging from 0 to 1) using a fuzzy comprehensive evaluation algorithm and populated into the corresponding positions in the matrix. The risk sensitivity dimension utilizes a dynamic weighting strategy. As the approval amount increases, its weight in the overall score increases exponentially. For example, when the amount exceeds 5 million yuan, the weight of this dimension increases from 0.3 to 0.5 or even higher, strengthening control over high-risk approval behavior. The resulting multi-dimensional verification result matrix provides structured and normalized foundational data for subsequent scoring calculations.

[0062] After the matrix is ​​constructed, the weighted scoring phase begins. This phase uses a weighted aggregation method to comprehensively evaluate the data in the matrix. First, the four-dimensional scores of each node are linearly weighted according to preset weights (e.g., 20% for role fit, 20% for data integrity, 40% for risk sensitivity, and 20% for timeliness compliance) to obtain a composite score for each node. The composite scores of all nodes are then aggregated at the path level to output the overall score for this permission verification process. The scoring matrix is ​​also scanned for significantly low individual scores, such as a node with a role fit of only 0.2 and a risk sensitivity of 0.9. These nodes are then marked as potentially high-risk. This process ultimately generates a permission verification report, which includes the overall pass rate, a detailed breakdown of risk-flagged nodes, and recommended solutions (such as recommendations for review, automatic transfer, or referral to a higher authority for approval), providing a basis for decision-making during the approval process.

[0063] Finally, the message encapsulation and push method is used to encapsulate the above-mentioned permission verification report into a standardized API response message. The encapsulated content includes fields such as the verification path list, the score of each node, the abnormal status, the comprehensive scoring results and the disposal suggestions, which comply with the unified format definition. After the encapsulation is completed, the standardized API response message is pushed to the approval engine of the OA system with the help of an asynchronous message queue. The receiver triggers the status change of the approval process based on the verification results in the message. If the verification pass rate is high and there are no high-risk nodes, the next approval node is automatically advanced; if there is a verification failure or a high-risk node, the current process is interrupted and a manual review or exception handling process is initiated. At this point, the entire closed-loop process from serial and parallel verification execution, result collection, multi-dimensional scoring, report generation to process flow triggering is completed, ensuring the accuracy, structure and controllability of permission verification.

[0064] Furthermore, in the method provided in the embodiment of the application, the process of starting the parallel verification thread pool to process the parallel verification conditions also includes: Perform execution analysis based on the parallel verification conditions to obtain the parallel condition complexity; dynamically adjust the number of threads according to the parallel condition complexity to create the parallel verification thread pool; traverse the parallel verification thread pool to perform environment matching and determine the thread execution environment parameters; activate the parallel verification thread pool according to the thread execution environment parameters to access and process the parallel verification conditions.

[0065] In an embodiment of the present application, in the process of processing parallel verification conditions, an execution analysis is first performed based on the parallel verification conditions, and the task counting method is used to traverse the verification nodes one by one to identify the number of nodes and the degree of sensitivity, and the complexity of the parallel conditions is obtained accordingly. The specific operation is to traverse each verification node in the parallel verification condition, count its total number, and evaluate whether it involves highly sensitive operations (such as high-authority role approval, external interface calls, etc.) based on the node attributes. Each basic node is scored 1 point. If it involves sensitive permissions or key business interfaces, an additional weighted point is scored. For example, if the parallel conditions include "legal approval", "budget approval" and "information security confirmation", of which "legal approval" and "information security confirmation" are highly sensitive operations, the total complexity is counted as 5. Through this method, a quantifiable parallel task complexity is obtained, which provides a basis for thread resource allocation.

[0066] The number of threads is then dynamically adjusted based on the complexity of the parallel condition, using a rule-based mapping method to configure the thread pool size. The default configuration rule is: if the complexity is ≤ 3, a fixed number of 3 threads is allocated; if the complexity is between 4 and 6, the number of threads is equal to the complexity multiplied by 1.5, rounded up; if the complexity is greater than 6, the number of threads is capped at 10, with 1-2 spare threads reserved for retries or handling blocked tasks. For example, when the complexity score is 5, the number of threads = 5 × 1.5 = 7.5, rounded up to 8. A thread pool with 8 core threads is created. This method results in a parallel verification thread pool whose thread number dynamically matches the task intensity.

[0067] After completing the thread pool construction, the stage of traversing the parallel verification thread pool for environment matching begins, and the sandbox mapping method is used to configure the thread execution environment parameters for each thread. To prevent data pollution or state conflicts between concurrent tasks, an independent sandbox execution environment is allocated to each thread. The sandbox environment includes the thread's own cache space, access token, interface connection context, log path, etc. Taking thread T1 responsible for "legal approval" as an example, its sandbox environment contains a dedicated token for the legal interface, a temporary approval log cache directory, and an independent database connection credential. This method ensures that all threads are physically and logically isolated and run, ensuring the data integrity and execution independence of each parallel verification path.

[0068] Finally, the parallel verification thread pool is activated according to the thread execution environment parameters, and access processing for the parallel verification conditions is performed. This process utilizes a distributed locking method to implement locking control on key resources (such as the permission data table and the approval status field), ensuring the atomicity and consistency of access operations between threads. For example, when multiple threads need to access the "user permission table" simultaneously, only the thread that has obtained the lock can perform read and write operations; the remaining threads must wait for the lock to be released before continuing. This method ensures the atomicity and consistency of shared data access for all parallel tasks.

[0069] In the embodiments of the present application, in summary, the embodiments of the present application have at least the following technical effects: This application receives an approval request triggered by an OA system, extracts information based on the approval request, obtains user identity information and a set of approval content labels; triggers a multi-level permission verification mechanism based on the user identity information, and generates a set of dynamic verification rules; performs permission verification on the approval content labels according to the dynamic verification rule set, and formulates target verification rules; executes the target verification rules to perform multi-level cross-verification on user permissions, generates a permission verification report based on the verification results, and feeds the permission verification report back to the OA system to trigger a subsequent approval process. The present invention solves the technical problem in the prior art that static rule configuration of the permission verification process is fixed, resulting in low efficiency of the approval process and inaccurate permission control. By introducing a dynamic verification rule generation mechanism, semantic label parsing and context dependency modeling, multi-level cross-verification and other means, the technical effect of improving the flexibility and accuracy of permission verification, and enhancing the security and intelligence level of the approval process is achieved.

[0070] Example 2, based on the same inventive concept as the authority verification method applied to OA approval in the above embodiment, Figure 2 As shown, this application provides an authority verification system for OA approval. The system and method embodiments in the embodiments of this application are based on the same inventive concept. The system includes: The approval request receiving module 11 is used to receive the approval request triggered by the OA system, extract the user identity information and the approval content label set according to the approval request; the verification rule generating module 12 is used to trigger the multi-level permission verification mechanism based on the user identity information and generate a dynamic verification rule set; the permission verification module 13 is used to perform permission verification on the approval content label according to the dynamic verification rule set and formulate target verification rules; the permission verification report generating module 14 is used to execute the target verification rules to perform multi-level cross-verification on user permissions, generate a permission verification report according to the verification results, and feed the permission verification report back to the OA system to trigger the subsequent approval process.

[0071] Furthermore, the system is also used to implement the following functions: The encrypted approval request stream received by the OA system is obtained through the API gateway, and the encrypted approval request stream is parsed to obtain a structured request message; user identity information is extracted from the structured request message, and the user identity information includes a request header field and request body data; user identity verification is performed based on the request header field, and when the identity verification passes, the request body data is semantically segmented to generate the approval content tag set.

[0072] Furthermore, the system is also used to implement the following functions: Parse the request header field, extract the user identity identifier, perform multi-dimensional verification on the user identity identifier through a distributed identity authentication service, and generate an identity verification result; when the identity verification result is that the identity verification passes, perform semantic segmentation on the approval content text in the request body data, and extract key entity tags, approval type tags, and approval content risk level tags; according to the approval content risk level tags, perform structured association matching on the key entity tags and the approval type tags to generate the approval content tag set.

[0073] Furthermore, the system is also used to implement the following functions: Parse the user identity information to obtain user identity attribute information; extract the user role level based on the user identity attribute information, and divide the multiple verification levels according to the user role level; match the approval content label set with the multiple verification levels, and when the matching result is the same verification level, obtain a serial verification condition; when the matching result is different verification levels, obtain a parallel verification condition; dynamically combine the approval content risk level label with the serial verification condition and the parallel verification condition to generate the dynamic verification rule set.

[0074] Furthermore, the system is also used to implement the following functions: The verification rule template library is called according to the approval content risk level label, and the serial verification conditions and the parallel verification conditions are retrieved and matched based on the verification rule template library; context analysis is performed based on the approval type label to determine the context relevance, and the serial verification conditions are verified and sorted according to the context relevance to determine the serial verification priority sequence; the serial verification conditions are logically combined with the parallel verification conditions according to the serial verification priority sequence through the dynamic rule engine to generate the dynamic verification rule set.

[0075] Furthermore, the system is also used to implement the following functions: Retrieve multiple business scenario information of OA approval, and construct a business knowledge graph based on the approval type label and the multiple business scenario information; mark the contextual correlation between approval requests and historical approval cases through the business knowledge graph to generate a correlation scoring matrix; traverse the series verification conditions according to the correlation scoring matrix to determine the context dependency; topologically sort the series verification conditions based on the context dependency to generate the series verification priority sequence.

[0076] Furthermore, the system is also used to implement the following functions: The serial verification conditions are used as nodes and the context dependencies are used as edges to construct a directed acyclic graph of verification nodes; weights are assigned to the edges of the directed acyclic graph according to the association score matrix, and a verification node influence factor matrix is ​​constructed based on the weight assignment results; the verification node with the highest comprehensive value of the verification node influence factor is selected as the first node of the serial link; based on the first node of the serial link, the remaining nodes of the serial link are arranged in descending order according to the security weight to generate the serial verification priority sequence.

[0077] Furthermore, the system is also used to implement the following functions: The serial verification conditions are executed according to the serial verification priority sequence through a multi-level verification engine, and a parallel verification thread pool is started to process the parallel verification conditions for real-time collection, and a multi-dimensional verification result matrix is ​​constructed; weighted scoring is performed based on the multi-dimensional verification result matrix to generate a permission verification report; the permission verification report is encapsulated as a standardized API response message, and the standardized API response message is pushed to the OA system through an asynchronous message queue to trigger a status change of the subsequent approval process.

[0078] Furthermore, the system is also used to implement the following functions: Perform execution analysis based on the parallel verification conditions to obtain the parallel condition complexity; dynamically adjust the number of threads according to the parallel condition complexity to create the parallel verification thread pool; traverse the parallel verification thread pool to perform environment matching and determine the thread execution environment parameters; activate the parallel verification thread pool according to the thread execution environment parameters to access and process the parallel verification conditions.

[0079] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0080] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

[0081] This specification and drawings are merely illustrative of the present application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of this application. Thus, this application is intended to include such modifications and variations as fall within the scope of this application and its equivalents.

Claims

1. The permission verification method applied to OA approval is characterized by: The method comprises: Receive the approval request triggered by the OA system, extract the user identity information and the approval content tag set according to the approval request; Triggering a multi-level authority verification mechanism based on the user identity information to generate a dynamic verification rule set; Performing authority verification on the approval content tag according to the dynamic verification rule set and formulating target verification rules; Execute the target verification rules to perform multi-level cross-verification on user permissions, generate a permission verification report based on the verification results, and feed the permission verification report back to the OA system to trigger the subsequent approval process.

2. The authority verification method applied to OA approval according to claim 1, characterized in that: Receiving an approval request triggered by the OA system, extracting according to the approval request, obtaining user identity information and an approval content tag set, the method includes: Obtain the encrypted approval request flow received by the OA system through the API gateway, parse the encrypted approval request flow, and obtain a structured request message; Extracting user identity information from the structured request message, wherein the user identity information includes a request header field and request body data; The user identity is verified based on the request header field. When the identity verification is passed, the request body data is semantically segmented to generate the approval content tag set.

3. The authority verification method applied to OA approval according to claim 2, characterized in that: Performing user identity verification based on the request header field, and when the identity verification passes, performing semantic segmentation on the request body data to generate the approval content label set, the method includes: Parsing the request header field, extracting the user identity identifier, performing multi-dimensional verification on the user identity identifier through a distributed identity authentication service, and generating an identity verification result; When the identity verification result is that the identity verification is passed, semantic segmentation is performed on the approval content text in the request body data to extract key entity labels, approval type labels, and approval content risk level labels; According to the approval content risk level label, the key entity label and the approval type label are structurally associated and matched to generate the approval content label set.

4. The authority verification method applied to OA approval according to claim 3 is characterized in that: Based on the user identity information, a multi-level permission verification mechanism is triggered to generate a dynamic verification rule set, the method comprising: Analyze the user identity information to obtain user identity attribute information; Extracting the user role level according to the user identity attribute information, and dividing the user role level into multiple verification levels according to the user role level; Matching the approval content tag set with the multiple verification levels, and obtaining a serial verification condition when the matching results are the same verification level, and obtaining a parallel verification condition when the matching results are different verification levels; The dynamic verification rule set is generated by dynamically combining the approval content risk level label with the series verification condition and the parallel verification condition.

5. The authority verification method applied to OA approval according to claim 4 is characterized in that: Dynamically combining the approval content risk level label with the serial verification condition and the parallel verification condition to generate the dynamic verification rule set, the method includes: Calling a verification rule template library according to the approval content risk level label, and searching and matching the serial verification condition and the parallel verification condition based on the verification rule template library; Performing context analysis based on the approval type label to determine context relevance, sorting the serial verification conditions according to the context relevance, and determining a serial verification priority sequence; The dynamic rule engine logically combines the serial verification conditions with the parallel verification conditions according to the serial verification priority sequence to generate the dynamic verification rule set.

6. The authority verification method applied to OA approval according to claim 5, characterized in that: The method includes performing context analysis based on the approval type label to determine context relevance, sorting the serial verification conditions according to the context relevance, and determining a serial verification priority sequence. Retrieve multiple business scenario information for OA approval, and build a business knowledge graph based on the approval type label and the multiple business scenario information; Annotate the contextual relevance of approval requests and historical approval cases through the business knowledge graph to generate a relevance scoring matrix; Traversing the series verification conditions according to the relevance score matrix to determine context dependencies; The serial verification conditions are topologically sorted based on the context dependency to generate the serial verification priority sequence.

7. The authority verification method applied to OA approval according to claim 6, characterized in that: Topologically sorting the serial verification conditions based on the context dependency to generate the serial verification priority sequence, the method comprising: Using the serial verification conditions as nodes and the context dependencies as edges, constructing a directed acyclic graph of verification nodes; Assigning weights to the edges of the directed acyclic graph according to the association score matrix, and constructing a verification node influence factor matrix based on the weight assignment results; Selecting the verification node with the highest comprehensive value of the verification node impact factor as the first node of the series link; Based on the first node of the series link, the remaining nodes of the series link are arranged in descending order according to security weights to generate the series verification priority sequence.

8. The authority verification method applied to OA approval according to claim 5, characterized in that: Executing the target verification rules to perform multi-level cross-verification on user permissions, generating a permission verification report based on the verification results, and feeding the permission verification report back to the OA system to trigger a subsequent approval process, the method includes: Executing the serial verification conditions according to the serial verification priority sequence through a multi-level verification engine, starting a parallel verification thread pool to process the parallel verification conditions for real-time collection, and constructing a multi-dimensional verification result matrix; Perform weighted scoring based on the multi-dimensional verification result matrix to generate an authority verification report; The permission verification report is encapsulated as a standardized API response message, and the standardized API response message is pushed to the OA system through an asynchronous message queue to trigger a status change of the subsequent approval process.

9. The authority verification method applied to OA approval according to claim 8, characterized in that: Start the parallel verification thread pool to process the parallel verification conditions. The method includes: Perform execution analysis based on the parallel verification condition to obtain parallel condition complexity; Dynamically adjust the number of threads according to the complexity of the parallel conditions to create the parallel verification thread pool; Traversing the parallel verification thread pool to perform environment matching and determine thread execution environment parameters; The parallel verification thread pool is activated according to the thread execution environment parameters to perform access processing on the parallel verification conditions.

10. The authority verification system applied to OA approval is characterized by: The system comprises: An approval request receiving module is used to receive the approval request triggered by the OA system, extract the user identity information and the approval content tag set according to the approval request; A verification rule generation module is used to trigger a multi-level permission verification mechanism based on the user identity information and generate a dynamic verification rule set; An authority verification module is used to perform authority verification on the approval content tag according to the dynamic verification rule set and formulate target verification rules; The authority verification report generation module is used to execute the target verification rules to perform multi-level cross-verification on user permissions, generate an authority verification report based on the verification results, and feed the authority verification report back to the OA system to trigger the subsequent approval process.

Images