Dynamic team resource coordination and permission management method and system in multi-tenant environment

Abstract

This invention belongs to the technical fields of computer distributed systems, multi-tenant data isolation, and resource scheduling. Specifically, it relates to a method and system for dynamic team resource collaboration and permission management in a multi-tenant environment. The method includes: generating a global identifier for each individual and associating it with their workspace; calculating a comprehensive score based on the similarity between the user's skill vector and the project requirement vector, as well as load and quality factors, and automatically recommending members; generating tokens with time-sensitive declarations, and having an API gateway verify the token's validity and permission scope; dynamically routing cross-space data reference requests to the source space for zero-copy reading through a metadata mapping table; and automatically marking the associated token as invalid and revoking permissions when the project ends. This invention achieves automated formation of temporary teams, secure cross-space data referencing, and automatic permission invalidation, improving collaboration efficiency and system security.

Description

Technical Field

[0001] This invention relates to the fields of computer distributed systems, multi-tenant data isolation and resource scheduling technology, and in particular to a method and system for dynamic team resource collaboration and permission management in a multi-tenant environment. Background Technology

[0002] With the increasing prevalence of remote work, freelancing, and cross-organizational collaboration, the participants in project management are becoming increasingly diverse. The boundaries between individual users (such as consultants, freelancers, and experts) and enterprise users (such as permanent teams and temporary project teams) are becoming blurred. Existing project management software typically adopts a hierarchical tree structure of "organization-team-project," which has technical limitations such as fragmented account systems, rigid team structures, and contradictions between data isolation and sharing. Individuals cannot seamlessly switch identities between different companies or teams, and individual work results are difficult to reuse across teams. The addition and removal of temporary team members rely on manual operations by administrators, lacking an automated recommendation mechanism based on multi-dimensional feature vectors. The permission management for external consultants and part-time personnel is either too broad, leading to the risk of data leakage, or too narrow, hindering normal collaboration, and permissions cannot be automatically revoked after the project ends, posing a security risk. Existing role-based access control models cannot support dynamic and time-sensitive permissions. In addition, personal data and enterprise data are completely isolated, data sharing across workspaces lacks fine-grained control, and loosely coupled sharing based on referencing rather than copying cannot be achieved. Summary of the Invention

[0003] This invention proposes a method and system for dynamic team resource collaboration and permission management in a multi-tenant environment, aiming to solve the technical problems existing in the SaaS multi-tenant platform, such as the contradiction between data isolation and sharing in loosely coupled collaboration between individuals and teams, the inefficiency of dynamic team building, and the inability to automatically reclaim permissions.

[0004] In a first aspect, the present invention provides a method for dynamic team resource collaboration and permission management in a multi-tenant environment, including: Generate a globally unique identifier for each natural person and establish the first association between that globally unique identifier and their personal workspace; Based on the project creation request, a comprehensive score is calculated by combining the project requirement vector and the candidate user skill vector with the candidate user's load factor and quality factor, and a member recommendation list is generated based on the comprehensive score. In response to the selection of a recommended member and the acceptance of the invitation by the recommended member, an expiration token is generated. This token contains at least the user identifier, workspace identifier, project identifier, permission list, and expiration time. Intercept API requests, extract and verify the validity and permission scope of the token, and store the user information in the token into the request context after successful verification. Share data objects in the source workspace to the target workspace, create reference records in the metadata mapping table, and when a request to access the data object is received, dynamically route the request to the source workspace to read the data based on the reference records; After the project ends, all tokens associated with the project will be marked as invalid, and temporary member privileges will be revoked.

[0005] Furthermore, the comprehensive score is calculated as follows: first, the cosine similarity between the user skill vector and the project requirement vector is calculated, and then multiplied by the load factor adjustment coefficient and the quality factor adjustment coefficient. The load factor is the ratio of the number of currently active projects of the user to the preset maximum concurrent project threshold, and the quality factor is the ratio of the user's historical average project score to the full score.

[0006] Furthermore, the time-sensitive token is a JSONWeb token, signed using an asymmetric encryption algorithm, and its expiration time is bound to the project end date; when the project ends early or a member is removed, the token's unique identifier is added to a blacklist.

[0007] Furthermore, the steps for verifying the validity of the token also include: verifying whether the workspace identifier and project identifier in the token match the requested resource, and verifying whether the HTTP method and path of the request are within the scope limited by the token permission list.

[0008] Furthermore, the metadata mapping table records the source workspace identifier, target workspace identifier, object identifier, sharing permissions, and expiration time; the dynamic routing is implemented through a proxy interface, which reads data from the source workspace based on the reference record and returns it in a streaming manner without physical copying.

[0009] Furthermore, the method also includes: when a data object in the source workspace is updated, a change event containing the source workspace identifier, object identifier, and version number is published to a message queue; the subscribed target workspace consumes the message and performs a synchronization operation according to business rules to achieve eventual consistency of data across workspaces.

[0010] Furthermore, optimistic locking is implemented by setting a version field for each data object. When the target workspace updates data, it includes a version number. When the source workspace updates, it checks the version consistency. If they are inconsistent, the update is rejected.

[0011] Furthermore, revoking temporary member privileges at the end of the project includes: adding the associated token's unique identifier to the blacklist and deleting the associated records of external members from the project member table.

[0012] Furthermore, the user skill vector is extracted and normalized from historical project evaluations, uploaded document keywords, and certification exams through offline tasks; the project requirement vector is generated by semantically matching the requirement description text with the skill vocabulary and combining it with manually selected skill tags and their weights.

[0013] Secondly, this invention provides a dynamic team resource collaboration and permission management system in a multi-tenant environment, the system being used to execute the method, including: The unified identity authentication module is used to generate globally unique identifiers for natural persons and manage their association with workspaces; The dynamic team engine is used to calculate a comprehensive score based on the similarity between the project requirement vector and the user skill vector, the load factor, and the quality factor, and generate a member recommendation list. A hybrid access controller is used to generate and verify tokens with expiration claims and maintain a token blacklist. A multi-tenant data router is used to maintain a metadata mapping table for data references across workspaces and dynamically route data reference requests to the source workspace. An asynchronous message synchronizer is used to publish change events to a message queue when the source data is updated, so that the target workspace can consume them to achieve data consistency.

[0014] The technical effects of this invention are: (1) By generating a globally unique identifier for natural persons and establishing association relationships with various workspaces such as individuals, teams, and enterprises, it supports seamless switching between different workspaces without the need for repeated registration, enabling the convenient reuse of personal work results (documents, templates, experiences) in cross-team collaboration. This fundamentally solves the technical problems of fragmented account systems and overly tight coupling between personal and enterprise identities in existing technologies, and realizes a flexible collaboration mode of "one person, multiple spaces, one space, multiple roles".

[0015] (2) By adopting a comprehensive score calculation formula based on the cosine similarity between user skill vectors and project requirement vectors, combined with load factors and quality factors, a member recommendation list can be automatically and in real time generated. Compared with manual coordination or methods based on simple rules, this algorithm comprehensively considers skill matching degree, current workload and historical performance, which significantly improves the efficiency and rationality of temporary team formation and reduces the risk of project delays caused by member overload or skill mismatch.

[0016] (3) By generating time-sensitive tokens containing expiration times and fine-grained permission declarations, and uniformly verifying the validity of the tokens and their blacklist status at the API gateway layer, precise granting and automatic expiration of permissions for external members are achieved. When a project ends or a member is removed, the token's unique identifier is immediately added to the blacklist without waiting for natural expiration, completely eliminating the data leakage security risks caused by permission residues, while also avoiding frequent queries to the database permission table and improving system throughput.

[0017] (4) By maintaining a metadata mapping table to record data reference relationships across spaces and using a proxy interface to dynamically route data to the source workspace for streaming, "zero-copy" data sharing is achieved. This solution maintains logical isolation between personal and team data, supports fine-grained sharing permission control (read / write / copy), and allows the source workspace administrator to revoke references at any time. Compared to traditional full copying or complete isolation methods, it significantly saves storage resources and avoids consistency issues caused by data redundancy.

[0018] (5) Source data change events are published via message queues for asynchronous consumption and synchronization by the target workspace. Combined with optimistic locking version control and distributed locking mechanisms, this approach ensures eventual consistency of cross-workspace referenced data while reducing the impact on the performance of the source workspace. This solution effectively reduces the data conflict rate in concurrent update scenarios, ensuring that users always obtain an acceptable eventual consistent state.

[0019] (6) By automatically scanning completed projects through scheduled tasks, associated tokens are added to the blacklist in batches, project data is archived, and external member association records are cleaned up, thus realizing the fully automatic reclamation of permissions and team resources. This mechanism does not require manual intervention, fundamentally solving the management problem of residual member permissions after the disbandment of temporary teams, reducing system operation and maintenance costs, and meeting data compliance requirements. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the overall architecture of the dynamic team resource collaboration and permission management system in a multi-tenant environment proposed in this embodiment of the invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention aims to address the technical problems in existing SaaS multi-tenant platforms, such as the contradiction between logical data isolation and efficient sharing in workspaces when individuals participate in multiple temporary teams as independent entities, the reliance on manual operation for dynamic team creation, and the inability to automatically revoke external member permissions. This embodiment provides a method for dynamic team resource collaboration and permission management in a multi-tenant environment, referencing... Figure 1 As shown, this embodiment runs in a distributed computing environment consisting of a server cluster, a database cluster, a message queue middleware, and client devices, and adopts a microservice architecture design. Specifically, it includes: Unified Identity Authentication Module: Deployed on an authentication server cluster, it adopts the OAuth2.0 and OIDC protocols and uses JSONWeb tokens for identity management.

[0023] Dynamic Team Engine: Composed of an offline vector construction part (based on a big data processing framework) and an online recommendation part (microservices), the backend connects to a vector retrieval database (such as Elasticsearch) to store and retrieve user skill vectors, and can use an approximate nearest neighbor index to accelerate retrieval.

[0024] Hybrid access controller: Integrated into the API gateway layer, the gateway implements a token verification filter and connects to a key-value storage system (such as Redis) to store the token blacklist.

[0025] Multi-tenant data router: Deployed inside the application server as a common component, it implements data reference routing through metadata mapping tables (stored in a relational database) and caching.

[0026] Asynchronous message synchronizer: Based on message queue middleware (such as RocketMQ or Kafka), using a publish-subscribe pattern.

[0027] Front-end application: Uses modern front-end frameworks (such as React or Vue) and is accelerated via CDN.

[0028] This embodiment uses the following core data structure (described in database tables or similar storage format, without limiting specific SQL statements): 1. User-workspace association records.

[0029] Each record contains: a globally unique user identifier, a workspace identifier, a workspace type (distinguishing between individual, team, and enterprise), the user's role in that workspace, the time they joined, and the time they left. This structure supports an individual associating with multiple workspaces. When a user accepts a team invitation, the system adds a new association record; when a user switches workspaces, the system verifies the association and generates a new token.

[0030] 2. User skill vector recording.

[0031] Using the user's globally unique identifier as the primary key, a JSON-formatted vector is stored, where the key is the skill name and the value is the normalized proficiency level (range [0,1]). The version number and update time are also recorded. The vector dimension represents the total number of skills preset by the system (e.g., 200 common skills).

[0032] 3. Project requirement vector record.

[0033] Using the project identifier as the primary key, the system stores the project requirements vector (in JSON format), a list of required skills, estimated working hours, and a deadline. The dimensions of the requirements vector are consistent with those of the user's skill vector.

[0034] 4. Data reference records.

[0035] Each record contains: a reference identifier, a source workspace identifier, a target workspace identifier, an object identifier, an object type, sharing permissions (such as Boolean values ​​for read, write, and copy permissions), an expiration time, a last synchronization time, and a status (valid or revoked). This record is used to implement data referencing across workspaces without physical copying.

[0036] 5. Time-limited token declaration structure.

[0037] The token contains the following statements: user ID, current workspace ID, project ID, role list, permission list (an array of strings, such as "Task: View" or "Document: Limited Edit"), issuance time, expiration time, and unique token identifier.

[0038] The detailed implementation process of the method in this embodiment is as follows: Step S1: Unify account and workspace association.

[0039] When a user submits their identity information for registration, the unified identity authentication module generates a globally unique identifier (such as a UUID) for them. Simultaneously, the system automatically creates a personal workspace for the user and inserts a record of type "Personal" into the user-workspace association record.

[0040] When a user accepts an invitation from a team, the system inserts a new record into the associated records. The workspace type is "team" or "enterprise," and the role is set to the role specified when the invitation was made (such as "member" or "external consultant"). In this way, an individual can associate with multiple workspaces through a single global identifier.

[0041] Workspace switching process: After the user selects a target workspace on the frontend, the frontend sends a switching request to the backend, carrying the current token and the target workspace identifier. The backend first verifies whether the user has permission to access the target workspace (by querying related records). If the verification is successful, a new token is generated, in which the workspace identifier is updated to the target workspace, and other claims are regenerated based on the role in the new workspace. Simultaneously, the unique identifier of the old token is added to a blacklist, and its expiration time is set to match the remaining validity period of the old token. Upon receiving the new token, the frontend updates its local storage and reloads the application.

[0042] When issuing each JWT, the system stores the (jti, exp) key-value pair in Redis and sets its expiration time to exp. At the end of the project, these jti are retrieved by project ID, then added to a blacklist, and the blacklist's expiration time is set to (exp - current time). Alternatively, a simpler approach could be to not set an expiration time for jti in the blacklist, but instead check if the jti is in the blacklist and if its current time is less than the value of exp during verification. However, this requires additional storage of exp. It is recommended to specify an implementation method.

[0043] Step S2: Dynamic team building based on collaborative filtering.

[0044] (1) Construction of offline user skill vectors.

[0045] The system runs offline tasks periodically (e.g., daily) to calculate each user's skill vector from the following data sources: Historical Project Evaluation: The skill tags and ratings of the user in historical projects evaluated by other members, with the ratings normalized to the [0,1] range.

[0046] Document keyword extraction: Analyze user-uploaded documents and templates, extract keywords using a word frequency-inverse document frequency algorithm, match them with a preset skill vocabulary, and increase the weight of the corresponding skill dimension.

[0047] Certification Exams: Online courses or certification exams completed by users are converted into skill points based on the course difficulty level and exam scores, and then normalized.

[0048] Ultimately, each user's skill vector is represented as a multi-dimensional vector, with each component having a value between 0 and 1, and stored in the user skill vector record.

[0049] (2) Project requirement vector generation.

[0050] When a project manager creates a new project, they fill in the requirements description text, required skills tags (with "Required," "Priority," and "Reference" levels), estimated time, and deadline. The system generates a project requirements vector through the following steps: The requirement description text is segmented and stop words are removed. Then, a semantic model (such as word vectors or BERT) is used to perform semantic matching with the skill vocabulary to calculate the relevance score of each skill.

[0051] For skill tags manually selected by project managers, different weights are assigned according to the level (e.g., high weight for required, low weight for reference).

[0052] The text relevance score is combined with the manual weights according to a preset ratio to generate the original requirement vector, which is then normalized to obtain a unit vector.

[0053] (3) Online recommendation calculation.

[0054] When a project manager triggers intelligent recommendations, the dynamic team engine performs the following calculations for each candidate user (excluding members already in the project): Cosine similarity: Calculates the cosine similarity between the user skill vector and the project requirement vector. The formula is the dot product divided by the product of the moduli.

[0055] Load factor: The ratio of the number of currently active items per user to the system's preset maximum concurrent item threshold. When the load factor reaches or exceeds 1, it is considered to be at full load.

[0056] Quality factor: The ratio of the average rating a user receives across all historical projects to the maximum possible score.

[0057] The overall score is calculated as: cosine similarity multiplied by (1 minus the preset weight α multiplied by the load factor), then multiplied by (1 plus the preset weight β multiplied by the quality factor). The design principle of this formula is: higher similarity is better, lower load is better, and higher historical scores are better. α and β are configurable hyperparameters.

[0058] When a platform has a large user base, calculating the cosine similarity of all users becomes prohibitively expensive. In such cases, an approximate nearest neighbor index (such as Faiss or Elasticsearch's vector retrieval) can be used to reduce the computational complexity from linear to logarithmic levels. Specifically, user skill vectors are added to the index, and when querying, a demand vector is input, which returns the Top-K most similar users. Then, a comprehensive score is calculated only for these users.

[0059] The system sorts the results in descending order of overall score and returns the top N (N is configurable) as a recommendation list to the front end, along with the reasons for the recommendation (e.g., matching degree, current load, historical rating).

[0060] Step S3: Hybrid access control based on time-limited tokens.

[0061] (1) Three-tier permission model.

[0062] Personal Level: Users have complete control over the data in their personal space. When a user wants to share a personal document with a team, they can set sharing permissions (such as read-only, no write, no copy) through data referencing. The source user can revoke sharing at any time.

[0063] Team level: Team administrators can configure default roles for the team (such as "administrator", "member", "observer"). Each role has a preset set of permissions, based on a role-based access control model.

[0064] At the project level: For ad-hoc projects, project managers can assign specific permissions to each external member (such as "view tasks only" or "edit protocol documents"). These permissions are stored in a permission list of the time-sensitive token.

[0065] (2) Token generation.

[0066] When an external member accepts the invitation, the backend generates a time-limited token. The token is signed using an asymmetric encryption algorithm to prevent tampering. The token's declaration must include at least: user identifier, workspace identifier, project identifier, role list, permission list, issuance time, expiration time, and a unique token identifier. The expiration time is tied to the project's end date and can be set with a grace period (e.g., a certain number of days after the project ends).

[0067] (3) Token verification and blacklist.

[0068] The API gateway intercepts each request and performs the following verification process: Extract the token from the request header and verify the validity of the signature; Check if the token's expiration time is later than the current time; Check if the token's unique identifier exists in the blacklist (stored in a high-speed key-value store). If it exists, deny access. Verify that the workspace identifier and project identifier in the token match the corresponding identifier carried in the requested resource to prevent lateral privilege escalation. Permission matching: Retrieves the list of permissions from the token and matches it against the HTTP method and URL path of the current request. For example, the "Task: View" permission allows GET requests to access task-related interfaces but does not allow POST requests to create tasks. A path pattern matcher can be used for the matching rules.

[0069] After successful verification, the user information in the token is stored in the request context (such as a thread-local variable) for use by the business layer.

[0070] When a project ends early or a member is removed, the system adds the unique identifier of the token used by that member to the blacklist and sets the expiration time of the blacklist to be the same as the remaining validity period of the token.

[0071] Step S4: Cross-workspace data referencing and synchronization.

[0072] (1) Create a reference: The user selects a data object in the source workspace (such as personal space), selects "Share to target workspace", and sets sharing permissions (read, write, copy, etc.). The backend verifies whether the current user is the owner of the source object and whether it belongs to the target workspace. After successful verification, a record is inserted into the data reference record, including the source workspace identifier, target workspace identifier, object identifier, sharing permissions, expiration time, etc., and the status is set to valid.

[0073] (2) Resolution and Access: When a user in the target workspace accesses the shared object, the frontend first requests the resolution interface, passing in the object identifier and the target workspace. The backend queries the data reference records, finds the corresponding reference identifier and source workspace, and returns a proxy Uniform Resource Locator. The frontend then requests this proxy address.

[0074] The proxy interface's processing logic is as follows: It queries the reference record based on the reference identifier to obtain the source workspace identifier, object identifier, and sharing permissions. It parses the user identifier from the currently requested token to verify whether the user belongs to the target workspace and has read permissions (the intersection of the token permission list and the sharing permissions in the reference record is taken). After successful verification, it calls the source workspace's data service interface to retrieve the object content (e.g., reading a stream from object storage), and then returns the data stream to the client as is, without physical copying. This approach achieves zero-copy data sharing.

[0075] (3) Consistency guarantee, optimistic locking: Each data object maintains a version number field. The version number is incremented when the source workspace updates the object. If the target workspace has cached a copy, it will record the version number. When the target workspace attempts to update the local cache, it includes the version number. The source workspace checks whether the version number matches. If they do not match, the update is rejected, and the user is prompted to fetch the latest version again.

[0076] Asynchronous Message Queue: When a data object in the source workspace is updated, the system publishes a change event, including the source workspace identifier, object identifier, version number, and update time, to a specific topic in the message queue. All target workspace consumers subscribed to this topic pull the message and decide whether to synchronize immediately or with a delay based on business rules. Consumers call the source workspace's interface to obtain the latest content and update their local cache or replica.

[0077] Distributed locks: For critical reference data (such as contracts and quotations), a distributed lock (such as the Redis-based Redlock algorithm) is used before write operations to ensure that only one operator updates the data at a time. The lock holding time is limited, and the lock is released after the operation is completed to avoid write conflicts.

[0078] Eventual consistency verification: The system provides scheduled tasks to periodically compare the version numbers of the referenced source object with the target copy, generate inconsistency reports, and support one-click repair (forced synchronization).

[0079] For the reference corresponding to ref_id in the data_reference table, a local cache record is created when the target workspace is accessed for the first time (stored in Redishash, containing object_id and version). A scheduled task compares the version of the source object with the cached version. If they are inconsistent, they are marked as pending synchronization.

[0080] Step S5: Automatic permission revocation and team disbandment driven by the project lifecycle.

[0081] The system periodically (e.g., every morning) scans the database for projects with end dates earlier than the current date. For each completed project, the following operations are performed: Token Expiration: Query the unique identifiers of all external members associated with this project, use batch operations to add the unique identifiers to the blacklist, and set the expiration time to be consistent with the remaining validity period of the token.

[0082] Project archiving: Update the project status to "archived" and move the project-related data to the archive storage (or archive it through logical tags) to reduce the pressure on online tables.

[0083] Membership cleanup: Delete the associated records of external members from the project member table. For internal members, only remove their role association within the project, retaining their membership status in the team space.

[0084] Notification: The system generates an aggregate report, which is sent to the project manager via email or in-system message. The report includes a list of members whose permissions have been revoked, the amount of archived data, etc.

[0085] Through the above process, the temporary members' permissions will automatically expire after the project ends, without manual intervention, thus avoiding the security risks of residual permissions.

[0086] The following example illustrates all the steps mentioned above.

[0087] Scenario: Zhang San, a project manager at a consulting firm, needs to assemble a temporary team to complete a "digital transformation diagnosis" project for a manufacturing company.

[0088] (1) Registration and workspace: External expert Li Si has registered in the system and has a personal workspace containing multiple industry analysis templates.

[0089] (2) Project Creation and Intelligent Recommendation: Zhang San logs into the system, switches to the team space, and creates a project called "Digital Transformation Diagnosis". He fills in the requirement description: "Needs consultants with expertise in lean production, data analysis, and MES system implementation", and manually selects the required skill tags. The system generates a project requirement vector. Zhang San clicks "Intelligent Recommendation of Members", and the dynamic team engine calculates the comprehensive score, returning a recommendation list: 3 internal consultants and 2 external experts, along with the reasons for the recommendations (matching degree, current workload, historical scores).

[0090] (3) Invitation and permission configuration: Zhang San selects internal consultant Zhao Liu and external expert Li Si and sends invitations. After Li Si accepts the invitation, the system generates a time-limited token with permissions of "view tasks", "limited document editing" and "join meetings", and the expiration time is set to the project end date plus a grace period.

[0091] (4) Project Collaboration and Data Reference: During the project, Li Si shares a diagnostic template from his personal space with the team. The system creates a data reference record. When team members access the template, they stream the data from Li Si's personal space through a proxy interface without creating a copy.

[0092] (5) Project Completion and Permission Revocation: The project is completed ahead of schedule. Zhang San clicks "Complete Project". The system adds the unique identifiers of Li Si and others' tokens to the blacklist, updates the project status to archive, and deletes the external member association records. When Li Si tries to access project resources with the original token, the token is blocked by the blacklist, and the permission is automatically invalidated.

[0093] Based on the same inventive concept, embodiments of the present invention also provide a dynamic team resource collaboration and permission management system in a multi-tenant environment. The system is used to execute the above-described method, including: The unified identity authentication module is used to generate globally unique identifiers for natural persons and manage their association with workspaces; The dynamic team engine is used to calculate a comprehensive score based on the similarity between the project requirement vector and the user skill vector, the load factor, and the quality factor, and generate a member recommendation list. A hybrid access controller is used to generate and verify tokens with expiration claims and maintain a token blacklist. A multi-tenant data router is used to maintain a metadata mapping table for data references across workspaces and dynamically route data reference requests to the source workspace. An asynchronous message synchronizer is used to publish change events to a message queue when the source data is updated, so that the target workspace can consume them to achieve data consistency.

[0094] Through the above embodiments, this invention achieves loosely coupled collaboration between individuals and teams: individuals associate multiple workspaces through a global identifier, data is securely shared through referencing rather than copying, temporary teams are automatically recommended and formed based on multi-dimensional feature vectors, and external member permissions are automatically revoked through time-limited tokens and blacklist mechanisms. All algorithm logic, data structures, and interaction processes are publicly available and can be implemented by those skilled in the art without creative effort.

[0095] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A method for dynamic team resource collaboration and access control in a multi-tenant environment, characterized in that, include: Generate a globally unique identifier for each natural person and establish the first association between that globally unique identifier and their personal workspace; Based on the project creation request, a comprehensive score is calculated by combining the project requirement vector and the candidate user skill vector with the candidate user's load factor and quality factor, and a member recommendation list is generated based on the comprehensive score. In response to the selection of a recommended member and the acceptance of the invitation by the recommended member, an expiration token is generated. This token contains at least the user identifier, workspace identifier, project identifier, permission list, and expiration time. Intercept API requests, extract and verify the validity and permission scope of the token, and store the user information in the token into the request context after successful verification. Share data objects in the source workspace to the target workspace, create reference records in the metadata mapping table, and when a request to access the data object is received, dynamically route the request to the source workspace to read the data based on the reference records; After the project ends, all tokens associated with the project will be marked as invalid, and temporary member privileges will be revoked.

2. The method according to claim 1, characterized in that, The comprehensive score is calculated as follows: first, the cosine similarity between the user's skill vector and the project requirement vector is calculated, and then multiplied by the load factor adjustment coefficient and the quality factor adjustment coefficient. The load factor is the ratio of the number of currently active projects of the user to the preset maximum concurrent project threshold, and the quality factor is the ratio of the user's historical average project score to the full score.

3. The method according to claim 1, characterized in that, The time-sensitive token is a JSONWeb token, signed using an asymmetric encryption algorithm, and its expiration time is bound to the project end date; when the project ends early or a member is removed, the token's unique identifier is added to the blacklist.

4. The method according to claim 1, characterized in that, The steps for verifying the validity of a token also include: verifying whether the workspace identifier and project identifier in the token match the requested resource, and verifying whether the HTTP method and path of the request are within the scope defined by the token's permission list.

5. The method according to claim 1, characterized in that, The metadata mapping table records the source workspace identifier, target workspace identifier, object identifier, sharing permissions, and expiration time; the dynamic routing is implemented through a proxy interface, which reads data from the source workspace based on the reference record and returns it in a streaming manner without physical copying.

6. The method according to claim 1, characterized in that, The method further includes: when a data object in the source workspace is updated, a change event containing the source workspace identifier, object identifier, and version number is published to a message queue; the subscribed target workspace consumes the message and performs synchronization operations according to business rules to achieve eventual consistency of data across workspaces.

7. The method according to claim 6, characterized in that, Optimistic locking is implemented by setting a version field for each data object. When the target workspace updates data, it includes a version number. When the source workspace updates, it checks the version consistency. If they are inconsistent, the update is rejected.

8. The method according to claim 1, characterized in that, Revoking temporary member privileges at the end of the project includes: adding the associated token unique identifier to the blacklist and deleting the associated record of the external member from the project member table.

9. The method according to claim 1, characterized in that, The user skill vector is extracted and normalized from historical project evaluations, uploaded document keywords, and certification exams through offline tasks; the project requirement vector is generated by semantically matching the requirement description text with the skill vocabulary and combining it with manually selected skill tags and their weights.

10. A dynamic team resource collaboration and access control system in a multi-tenant environment, characterized in that: The system is used to perform the method according to any one of claims 1-9, comprising: The unified identity authentication module is used to generate globally unique identifiers for natural persons and manage their association with workspaces; The dynamic team engine is used to calculate a comprehensive score based on the similarity between the project requirement vector and the user skill vector, the load factor, and the quality factor, and generate a member recommendation list. A hybrid access controller is used to generate and verify tokens with expiration claims and maintain a token blacklist. A multi-tenant data router is used to maintain a metadata mapping table for data references across workspaces and dynamically route data reference requests to the source workspace. An asynchronous message synchronizer is used to publish change events to a message queue when the source data is updated, so that the target workspace can consume them to achieve data consistency.

Images