Abstract: A plurality of permissions associated with the on-demand computing services environment may be identified. Each of the permissions may identify a respective one or more actions permitted to be performed within the on-demand computing services environment. Each of the permissions may be granted to a respective one or more user accounts within the on-demand computing services environment. A degree of overlap between a first group of the user accounts granted a first one of the permissions and a second group of the user accounts granted a second one of the permissions may be determined. When the degree of overlap exceeds a designated threshold, a designated permission set that includes the first permission and the second permission may be created.

Abstract: A request to search a database field in a database table for a query value may be received. The query value may be hashed with a designated hash function and a designated hash key to produce a designated keyed-hash value. A row in the database table may be identified based on the designated keyed-hash value. The identified row may include a keyed-hash field value that matches the designated keyed-hash value. The identified row may include an encrypted field value generated by encrypting an unencrypted field value matching the query value. One or more data values associated with the identified row may be transmitted in response to the request.

Abstract: A plurality of permissions associated with the on-demand computing services environment may be identified. Each of the permissions may identify a respective one or more actions permitted to be performed within the on-demand computing services environment. Each of the permissions may be granted to a respective one or more user accounts within the on-demand computing services environment. A degree of overlap between a first group of the user accounts granted a first one of the permissions and a second group of the user accounts granted a second one of the permissions may be determined. When the degree of overlap exceeds a designated threshold, a designated permission set that includes the first permission and the second permission may be created.

Abstract: A plurality of permissions associated with the on-demand computing services environment may be identified. Each of the permissions may identify a respective one or more actions permitted to be performed within the on-demand computing services environment. Each of the permissions may be granted to a respective one or more user accounts within the on-demand computing services environment. A degree of overlap between a first group of the user accounts granted a first one of the permissions and a second group of the user accounts granted a second one of the permissions may be determined. When the degree of overlap exceeds a designated threshold, a designated permission set that includes the first permission and the second permission may be created.

Abstract: A digital data platform, e.g., suitable to support e-commerce, can utilize a digital data processing device—separate and apart from those used in client app authentication and request routing—for executing a token validation service to both generate and validate tokens. This frees the network gateway to route incoming requests for authorization separately from those from already-authorized apps. This is more cost-effective than adding gateways to provide such processing. By separating the token-generating logic from the gateways, this also allows tokens to be stored in and replicated among remote data centers.