Abstract: A method includes receiving, at a cloud storage system, a request to access a file from an external application on behalf of a first user account, determining, based on one or more access control lists (ACLs) associated with a shared folder, that the external application is not allowed to access the file on behalf of the first user account, and receiving, from a user device associated with the first user account, a message authorizing the external application to access the file on behalf of the first user account. The method further includes modifying the ACLs associated with the shared folder containing the file and a subfolder, and allowing the external application to access the file on behalf of the first user account based on the user information of the first user account and the application information of the external application in the modified ACLs.

Abstract: A system and method for recursive propagating application access control relate to managing third-party application access to content files and folders on a cloud storage system. The access control system may receive an access authorization indication to grant a third-party entity access to a parent folder containing a first file, and then modify an access control rule associated with the parent folder based on the access authorization indication. The modified access control rule is propagated to a child folder of the parent folder, and thus the third-party entity is granted access to a second file in the child folder based on the modified access control rule. The second file shares a common attribute with the first file, 1 and the modified access control rule specifies the common attribute.

Abstract: A system and method for recursive propagating application access control relate to managing third-party application access to content files and folders on a cloud storage system. The access control system may receive an access authorization indication to grant a third-party entity access to a parent folder containing a first file, and then modify an access control rule associated with the parent folder based on the access authorization indication. The modified access control rule is propagated to a child folder of the parent folder, and thus the third-party entity is granted access to a second file in the child folder based on the modified access control rule. The second file shares a common attribute with the first file, and the modified access control rule specifies the common attribute.

Abstract: A cloud storage system identifies and creates metadata associated with a stored file. On receiving a request to access the file with an application, the cloud storage system generates a metadata category associated only with the application, and creates metadata associated with the generated metadata category and corresponding to the file. On receiving a request to access file metadata, the cloud storage system identifies an application associated with the metadata access request, identifies a set of metadata categories associated with the identified application, filters metadata associated with the file based on the identified set of metadata categories, and provides the filtered metadata to the application.

Abstract: A cloud storage system identifies and creates metadata associated with a stored file. On receiving a request to access the file with an application, the cloud storage system generates a metadata category associated only with the application, and creates metadata associated with the generated metadata category and corresponding to the file. On receiving a request to access file metadata, the cloud storage system identifies an application associated with the metadata access request, identifies a set of metadata categories associated with the identified application, filters metadata associated with the file based on the identified set of metadata categories, and provides the filtered metadata to the application.