API-Based Account Permissions for Scoped Third-Party Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to provide appropriate account permissions for third-party access to computing systems, often leading to either restricted access that hinders support or overly broad access that compromises security.
Innovation Solution
Generate account permissions based on the application programming interface (API) scope of the external application, using API interactions to determine the resources accessed by the third-party, thereby automating the permission generation process and ensuring access is commensurate with the API scope.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If third-party is completely restricted from the administrator, then security is improved, but support and development capability deteriorates
Solution Approach 1:
The patent implements role-based access control where different third-party users are granted specific permissions based on their role (e.g., developer, support staff, auditor). Each role receives only the minimum necessary access to specific resources, allowing security maintenance while enabling appropriate support and development activities.
Solution Approach 2:
The system dynamically adjusts third-party access permissions based on the specific task or resource being accessed. Access is not static but is granted temporarily and specifically for particular administrative functions, allowing flexibility in support and development while maintaining security boundaries.
2Adaptability or versatility
If third-party is granted broad access to administrator, then support capability is improved, but security deteriorates
Solution Approach 1:
Instead of granting broad universal access, the system provides targeted access to specific administrative resources and functions. Each third-party user receives permissions tailored to their specific support needs, enabling effective support capability while limiting exposure of sensitive administrative areas.
Solution Approach 2:
The administrative access space is segmented into discrete resources and functions, with third-party permissions assigned at the granular level of individual resources rather than broadly across the entire administrator. This segmentation allows support capability for specific functions while maintaining security isolation.
3Measurement precision
If manual permission configuration is used, then access control precision is improved, but time consumption deteriorates
Solution Approach 1:
The system pre-configures role templates with standard permission sets for common third-party roles (developers, support staff, auditors). This preliminary configuration eliminates the need to manually configure each permission from scratch, reducing time consumption while maintaining precise access control through the pre-defined role structures.
Solution Approach 2:
The system enables automatic permission assignment based on user roles and resource requirements, reducing manual configuration effort. Permission management becomes a self-service process where the system automatically determines appropriate access levels based on predefined criteria and user contexts.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for generating account permissions for an account on a computing system are provided. In some embodiments, application programming interface (API) interactions involving an external application and the computing system are used to generate a corresponding set of account permissions for the account. API permissions for the external application may also or instead be used to generate the set of account permissions for the account. The set of account permissions may enable the account to access the same resources on the computing system as the external application, which may avoid granting the account overly broad access to the computing system.