Abstract: A system and method for dynamically determining a set of relevant rule instances based on a set of context attribute values comprising a directory server, an attribute data store, and a rules engine. The directory server includes rule instances having hierarchical structure. The attribute data store has a hierarchical structure and is configured to provide a set of hierarchically relevant context attribute values optimized from the rule instances, based on the set of context attribute values. The rules engine is configured to provide the set of context attribute values to the attribute data store in accordance with the context from the context provider, and to determine a set of relevant rule instances, based on the hierarchically relevant context attribute values from the attribute data store.

Abstract: A system and method for selectively granting access to a target object. In one embodiment, the system includes an object data store, an access control instruction data store, an action data store, a context, and an access determination engine. The object data store includes a plurality of hierarchically structured target objects and a plurality of hierarchically structured actor objects. The access control instruction data store includes a plurality of hierarchically structured access control instructions. The action data store comprising a plurality action objects. The context includes an actor attribute, an action attribute, and a target attribute. The access determination engine configured to selectively grant access to the target object based on a first set of access control instructions having attributes that match the context and a second set of access control instructions having attributes that are hierarchically broader than the attributes of the context.