Abstract: A policy that governs access to a resource may be tested against real-world access requests before being used to control access to the resource. In one example, access to a resource is governed by a policy, referred to as an effective policy. When the policy is to be modified or replaced, the modification or replacement may become a test policy. When a request is made to access the resource, the request may be evaluated under both the effective policy and the test policy. Whether access is granted is determined under the effective policy, but the decision that would be made under the test policy is noted, and may be logged. If the test policy is determined to behave acceptably when confronted with real-world access requests, then the current effective policy may be replaced with the test policy.

Abstract: A policy that governs access to a resource may be tested against real-world access requests before being used to control access to the resource. In one example, access to a resource is governed by a policy, referred to as an effective policy. When the policy is to be modified or replaced, the modification or replacement may become a test policy. When a request is made to access the resource, the request may be evaluated under both the effective policy and the test policy. Whether access is granted is determined under the effective policy, but the decision that would be made under the test policy is noted, and may be logged. If the test policy is determined to behave acceptably when confronted with real-world access requests, then the current effective policy may be replaced with the test policy.

Abstract: A connected account provider system allows a user of multiple electronic devices to set up a user account on one device with the device's settings saved in the cloud for application across different devices. A user can obtain secure access to the saved settings using a second (or subsequent) device and can select settings from the initial device to be synchronized to the second device. The system employs client account provider (CAP) software that can be obtained from an independent software provider and is installed on different devices of a user. The CAP client software creates an architecture on a user's device with a CAP client software layer conceptually separate from the device's operating system software. The CAP client software provides extension points for facilitating connection between connected user devices' operating systems and a cloud services layer typically provided by the CAP client software vendor.

Abstract: One or more labels are associated with a data object. One or more policies are associated with each of the labels. Based on the labels associated with the data objects, the associated policies are dispatched to policy decision engines to take one or more actions to enforce the policy. The labels, and the policies associated with the labels, are chosen by a business administrator within an enterprise, and are implemented by an Information Technology (IT) administrator. The association between labels and polices allows the policy to be applied to an object to be decoupled from the characterization of the nature of the object, or its purpose and/or role within an enterprise, business purpose and/or context of the object. Examples of policies are: access, backup, retention, isolation, audit, etc.

Abstract: A method of determining membership in a group includes receiving a request to determine if an element is a member of a group. The request may be generated by a software application where the application provides at least one parameter to a script which resides external to the application. The script, along with an optional application-provided parameter, is evaluated to determine the membership of the element in the group. Generally, the script is flexibly generated by an administrator independent of the development of the application. After evaluation, a response is sent back to the application where the response is an indication of membership of the element in the group. The method may optionally allows the script to access an external data source to provide additional information to determine membership. In some applications of the invention, determinations of membership may be used for access determination purposes.