Nested Permissions Policy Generation for Microservices

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In microservices environments, security administrators face challenges in identifying and granting permissions across a chain of dependent software components due to different teams developing and maintaining these components, leading to inefficiencies in managing user permissions.

Innovation Solution

A system that generates and modifies permissions policies based on user-defined configuration rules, iteratively analyzing metadata to identify nested sets of action/artifact pairs, and recursively updating security policies to ensure comprehensive permission management across multiple software components.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If security administrators manually identify and grant permissions across dependent software components, then permission management can be customized for each component, but the process becomes time-consuming and inefficient

Engineering Contradiction:

Improvepermission management efficiencyVSAvoidtime to identify and grant permissions

Core Design Contradiction:

Ease of operationVSLoss of time

Solution Approach 1:

The system performs preliminary analysis of the chain of dependent software components and pre-identifies all required permissions before the security administrator needs to grant them. By analyzing component dependencies in advance and preparing the permission list, the system eliminates the time-consuming manual identification process while maintaining customized permission granting.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system automatically analyzes software component dependencies and generates the complete list of required permissions without human intervention. The security administrator only needs to review and approve the generated permissions, transforming the manual identification task into an automated self-service process that significantly reduces time loss.

Inventive Principle:

Principle #25Self-service

2Reliability

If security administrators review every software component in the dependency chain, then comprehensive permission coverage is achieved, but the complexity of the process increases

Engineering Contradiction:

Improvepermission coverage completenessVSAvoidpermission management process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system segments the complex dependency chain analysis into manageable parts by automatically identifying and analyzing each software component's dependencies individually. It then aggregates these segmented results to provide comprehensive permission coverage, reducing the perceived complexity for the security administrator while maintaining complete coverage.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces an automated analysis intermediary that sits between the security administrator and the complex dependency chain. This intermediary automatically reviews all software components, analyzes their dependencies, and presents a simplified summary of required permissions, reducing process complexity while ensuring comprehensive coverage through the intermediary's thorough analysis.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If teams develop software components independently, then development speed and team autonomy are improved, but identifying required permissions across teams becomes difficult

Engineering Contradiction:

Improvesoftware component development speedVSAvoidinformation about required permissions

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The system establishes a feedback mechanism that automatically collects information about software component dependencies from various teams. By analyzing the feedback data about component interactions and dependencies, the system reconstructs the complete permission requirements across teams, preserving permission information despite independent development that would otherwise cause information loss.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system creates a universal permission analysis framework that works across multiple independent teams and diverse software components. This multi-functional system can analyze any type of software component dependency regardless of which team developed it, ensuring that permission information is captured and preserved universally across the entire system architecture.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20260064864A1Nested Permissions Policy Generation

Publication Date: 2026.03.05 ORACLE INT CORP

AI summary

Techniques for generating permissions policies for nested sets of software artifacts are disclosed. A system detects a selection of a target action and a target software artifact. The system identifies an entity associated with the selection. The system analyzes permissions metadata of the target software artifact to identify user-defined permission configuration rules specifying one or more additional software artifacts and one or more additional actions associated with the additional software artifacts. The system performs an iterative analysis of permissions metadata in the nested software artifacts to generate a composite permissions policy for the entity that combines the permissions specified in the user-defined permission configuration rules for the set of nested software artifacts.