Abstract: A method for managing an operation includes: receiving a request from a data protection module with respect to assigning a security officer role (SOR) to a person; in response to the request and at a first point-in-time, initiating assignment of the SOR to the person; receiving, at a second point-in-time, a notification from the data protection module indicating that the SOR is assigned to the person; in response to the notification, sending a second request to the data protection module to execute the operation; after the sending the second request: making a first determination that the second request has not been approved; waiting, based on the first determination, until the second request is approved by the person or a second person assigned the SOR; making a second determination that the second request is approved by the second person; and continuing, based on the second determination, execution of the operation.

Abstract: A request is received from a first agent, the request having a filesystem namespace and an operation identifier (ID) identifying one or more operations to be performed within the file system namespace. In response to the request, a security unit is identified based on a first agent ID identifying the first agent. It is determined whether the security unit contains an operation set ID corresponding to the operation ID of the request. It is determined whether the security unit contains information identifying a set of one or more file system management object (FSMOs) associated with the requested filesystem namespace. The one or more operations are allowed to be performed on the one or more FSMOs, in response to determining that the security unit contains information matching the operation ID of the request and the filesystem namespace of the first request.

Abstract: Exemplary methods include receiving a message from an agent requesting to perform a first set of operations on a first set of storage namespaces mapped to a first set of file system management objects (FSMOs) in the PBBA. The methods include determining whether to allow or deny the first set of operations based on information stored in a plurality of security units, each security unit comprising of an operation set identifier (ID), a set of FSMO IDs, and an agent ID, wherein the agent ID identifies an agent that is allowed to perform a set of operations identified by the operation set ID on a set of FSMOs in the PBBA identified by the set of FSMO IDs, and in response to determining to allow the first set of operations, performing the first set of operations.