Abstract: A request is received from a first agent, the request having a filesystem namespace and an operation identifier (ID) identifying one or more operations to be performed within the file system namespace. In response to the request, a security unit is identified based on a first agent ID identifying the first agent. It is determined whether the security unit contains an operation set ID corresponding to the operation ID of the request. It is determined whether the security unit contains information identifying a set of one or more file system management object (FSMOs) associated with the requested filesystem namespace. The one or more operations are allowed to be performed on the one or more FSMOs, in response to determining that the security unit contains information matching the operation ID of the request and the filesystem namespace of the first request.

Abstract: Exemplary methods include receiving a message from an agent requesting to perform a first set of operations on a first set of storage namespaces mapped to a first set of file system management objects (FSMOs) in the PBBA. The methods include determining whether to allow or deny the first set of operations based on information stored in a plurality of security units, each security unit comprising of an operation set identifier (ID), a set of FSMO IDs, and an agent ID, wherein the agent ID identifies an agent that is allowed to perform a set of operations identified by the operation set ID on a set of FSMOs in the PBBA identified by the set of FSMO IDs, and in response to determining to allow the first set of operations, performing the first set of operations.