Abstract: A data processing system for controlling data access to a secured resource of a distributed system implements receiving, from a first user device of a first user, a first request to access a secured resource and a first security token, the first security token including group information for one or more first access control groups associated with the secured resource of which the first user is a member; accessing group access policy information for groups associated with the secured resource; determining, based on the group information included in the first security token and the group access policy information, that the first user is a member of at least one group that is permitted to access the secured resource; and permitting the first user device of the user to access the secured resource responsive to determining that the first user is a member of at least one group that is permitted to access the secured resource.

Abstract: A computing system divides users into segments, each segment having a communication/collaboration policy that indicates how users assigned to the segment can communicate and collaborate with users of other segments. The users can be added to groups. Membership in the groups is controlled based on evaluation of the policies of the segments to which the users belong, a moderated group can have members that collaborate across segment boundaries.

Abstract: A group of users is segmented into segments, each segment having a communication/collaboration policy that indicates how users assigned to the segment can communicate and collaborate with users of other segments. A user is input for addition to a group. The policies of the segments to which the user belong are evaluated against the policies of segments to which other users in the group belong. The recommended user is added to the group based upon the analysis. Communication and collaboration with other users is managed based upon the users membership in the group.

Abstract: A data processing system for controlling data access to a secured resource of a distributed system implements receiving, from a first user device of a first user, a first request to access a secured resource and a first security token, the first security token including group information for one or more first access control groups associated with the secured resource of which the first user is a member; accessing group access policy information for groups associated with the secured resource; determining, based on the group information included in the first security token and the group access policy information, that the first user is a member of at least one group that is permitted to access the secured resource; and permitting the first user device of the user to access the secured resource responsive to determining that the first user is a member of at least one group that is permitted to access the secured resource.