Row-level and column-level policy service

Patent metadata

Field	Value
Publication number	US-12367305-B2
Application number	US-202117646341-A
Country	US
Kind code	B2
Filing date	Dec 29, 2021
Priority date	Jun 11, 2018
Publication date	Jul 22, 2025
Grant date	Jul 22, 2025

Abstract

Example embodiments relate to a policy service employed to perform operations to: generate and maintain a data-set that comprises at least a column and a row that intersect at a cell; assign an access policy to a row or column of the data-set, wherein the access policy is defined by one or more access credentials required to receive access the cell that intersect with the row or column; receive a request to read the data-set from a user account, wherein the user account has an associated credential; filter the cell that intersects with the row or column of the data-set based on the access policy and the credential of the user account, in response to receiving the request from the user account; and provide the user account with access to the filtered data-set.

First claim

What is claimed is:

1. A method comprising:
accessing a data-set that comprises a column and a row that intersect at a cell, the cell comprising content;
receiving an input that selects an access policy identifier from among a set of access policy identifiers, the access policy identifier corresponding with a predefined access policy that defines a set of credentials;
assigning the predefined access policy that corresponds with the access policy identifier to the row of the data-set;
receiving a request to access the data-set from a client device associated with a user account;
filtering the content from the cell based on a credential associated with the user account and the predefined access policy assigned to the row; and
causing display of a presentation of at least a portion of the data-set at the client device, the presentation of the data-set including a display of the cell, the display of the cell including an indication having indication content indicating that data has been filtered from the content, the indication content including content more than a blank.

2. The method of claim 1 , wherein the receiving the request to access the data-set further comprises:
maintaining the credential of the user account at a memory location;
associating the memory location with an identifier of the user account; and
accessing the credential associated with the user account at the memory location responsive to the request.

3. The method of claim 1 , wherein the receiving the input that selects the access policy identifier from among the set of access policy identifiers further comprises:
causing display of a menu element at a position within a GUI based on the accessing the data-set, the menu element comprising a display of a set of access policy identifiers that include the access policy identifier; and
wherein the input selects the access policy identifier from among the set of access policy identifiers within the menu element.

4. The method of claim 1 , wherein the receiving the input that selects the access policy identifier from among the set of access policy identifiers further comprises:
receiving a selection of the row of the data-set;
causing display of a menu element at a position within a GUI responsive to the selection of the row, the menu element comprising a display of a set of access policy identifiers that include the access policy identifier; and
wherein the input selects the access policy identifier from among the set of access policy identifiers within the menu element.

5. The method of claim 1 , wherein the predefined access policy defines read and write permissions associated with the row of the data-set.

6. The method of claim 1 , wherein the assigning the predefined access policy to the row of the data-set further comprises:
receiving a first user input that defines the credentials of the predefined access policy;
receiving a second user input that identifies the row of the data-set; and
assigning the predefined access policy to the cell that intersects with the row of the data-set.

7. A system comprising:
a memory; and
at least one hardware processor coupled to the memory and comprising instructions that causes the system to perform operations comprising:
accessing a data-set that comprises a column and a row that intersect at a cell, the cell comprising content;
receiving an input that selects an access policy identifier from among a set of access policy identifiers, the access policy identifier corresponding with a predefined access policy that defines a set of credentials;
assigning the predefined access policy that corresponds with the access policy identifier to the row of the data-set;
receiving a request to access the data-set from a client device associated with a user account;
filtering the content from the cell based on a credential associated with the user account and the predefined access policy assigned to the row; and
causing display of a presentation of at least a portion of the data-set at the client device, the presentation of the data-set including a display of the cell, the display of the cell including an indication having indication content indicating that data has been filtered from the content, the indication content including content more than a blank.

8. The system of claim 7 , wherein the receiving the request to access the data-set further comprises:
maintaining the credential of the user account at a memory location;
associating the memory location with an identifier of the user account; and
accessing the credential associated with the user account at the memory location responsive to the request.

9. The system of claim 7 , wherein the receiving the input that selects the access policy identifier from among the set of access policy identifiers further comprises:
causing display of a menu element at a position within a GUI based on the accessing the data-set, the menu element comprising a display of a set of access policy identifiers that include the access policy identifier; and
wherein the input selects the access policy identifier from among the set of access policy identifiers within the menu element.

10. The system of claim 7 , wherein the receiving the input that selects the access policy identifier from among the set of access policy identifiers further comprises:
receiving a selection of the row of the data-set;
causing display of a menu element at a position within a GUI responsive to the selection of the row, the menu element comprising a display of a set of access policy identifiers that include the access policy identifier; and
wherein the input selects the access policy identifier from among the set of access policy identifiers within the menu element.

11. The system of claim 7 , wherein the access policy defines read and write permissions associated with the row of the data-set.

12. The system of claim 7 , wherein the predefined assigning the access policy to the row of the data-set further comprises:
receiving a first user input that defines the credentials of the predefined access policy;
receiving a second user input that identifies the row of the data-set; and
assigning the predefined access policy to the cell that intersects with the row of the data-set.

13. A non-transitory machine-readable storage medium comprising instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising:
accessing a data-set that comprises a column and a row that intersect at a cell, the cell comprising content;
receiving an input that selects an access policy identifier from among a set of access policy identifiers, the access policy identifier corresponding with a predefined access policy that defines a set of credentials;
assigning the predefined access policy that corresponds with the access policy identifier to the row of the data-set;
receiving a request to access the data-set from a client device associated with a user account;
filtering the content from the cell based on a credential associated with the user account and the predefined access policy assigned to the row; and
causing display of a presentation of at least a portion of the data-set at the client device, the presentation of the data-set including a display of the cell, the display of the cell including an indication having indication content indicating that data has been filtered from the content, the indication content including content more than a blank.

14. The non-transitory machine-readable storage medium of claim 13 , wherein the receiving the request to access the data-set further comprises:
maintaini

Assignees

• Palantir Technologies Inc

Inventors

• Krieger Brandon
• Elliot Mark
• Lynch Matthew

Classifications

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/31

  User authentication · CPC title

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title