CRM Field Access Control via Segmented Privilege Inheritance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Customer Relationship Management (CRM) systems face challenges in securely managing access to sensitive records due to restrictive access settings, user roles, and organizational policies, which limit user privileges and hinder secure communication with CRM services.
Innovation Solution
A CRM application determines the user's identity and access level based on secured field instance settings, enabling access by executing a selected action path using Principle Object Attribute Access (POAA) to grant, modify, or revoke access to secured field instances through Create, Update, and Delete APIs, ensuring secure access to sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If restrictive access settings and security policies are implemented to protect private information, then data security is improved, but user access flexibility deteriorates
Solution Approach 1:
The patent segments access control at the field level within records, allowing granular permission management. Instead of treating all fields uniformly, the system divides access rights into specific field instances, enabling selective access to sensitive versus non-sensitive data based on user roles and organizational policies.
Solution Approach 2:
The system dynamically determines user access rights by evaluating multiple factors including user identity, record properties, field security settings, and organizational policies. Access decisions are made in real-time based on the action path executed, allowing flexible adaptation to different access scenarios while maintaining security.
2Ease of operation
If client applications request access to CRM records with private information, then operational needs are met, but security restrictions override access rights
Solution Approach 1:
The patent introduces an intermediary access control mechanism that sits between client applications and CRM records. This intermediary evaluates security policies, user roles, and field-level settings before allowing access, mediating between the operational needs of applications and the security requirements of private information.
Solution Approach 2:
Different fields within the same record are assigned different security qualities. Sensitive fields have stricter access controls while non-sensitive fields have more permissive access. This local differentiation allows client applications to access necessary data while protecting private information according to field-specific security settings.
3Reliability
If user roles and organizational restrictions are enforced to protect secured records, then data protection is improved, but access complexity increases
Solution Approach 1:
The system performs preliminary evaluation of user identity, roles, and organizational policies before executing any data access operation. By determining access rights in advance based on pre-configured security settings and user attributes, the system simplifies the actual access execution while maintaining comprehensive protection.
Solution Approach 2:
The access control mechanism serves multiple functions simultaneously: it authenticates users, evaluates roles, enforces organizational policies, and manages field-level security. This multi-functional approach consolidates what would otherwise be separate complex systems into a unified access determination process.
Data Source
AI summary
Access to customer relationship management (CRM) secured field instances is enabled based on field settings. A requester's identity determines action paths to be executed in order to enable access to fields. A client application's user privileges are inherited to enable access to secured fields. Such access through a granted privilege is provided through an API intermediating inheritance of user's privileges from client application.