Abstract: Managing actions associated with objects stored in a data storage system includes: receiving, over an input device or port, a request to determine authorization of an action associated with an object; and computing, with at least one processor, authorization information for processing the received request. The computing includes: determining a class of the object, retrieving a rule specification associated with the class, and evaluating at least one rule defined in the retrieved rule specification or defined in rule specifications associated with classes of any objects referenced in the retrieved rule specification.