Method and apparatus for managing and displaying user authorizations for a business process managed using a state machine

Abstract

A method and apparatus are disclosed for managing access control for a business process that is managed using a state machine. A domain represents the various trading mechanisms that are supported by a business process. Domains are placed at the highest level in a tree structure. Within each domain, there is one or more different flow types defined, such as flow types for buyers and sellers. Within each flow type, one or more flows or business processes may be defined. A flow defines the order of the steps required to produce an object. Each flow typically begins with a mandatory 'start' state, having one or more transitions to additional states. Each transition may contain an access control guard. The guards on the transitions leading from the start state can be referenced to determine the user's authorization to access the domains, flow types, and flows. In this manner, the menu of options presented to the user may be automatically tailored to present only those actions which the particular user is authorized to perform. Thus, a navigational tool is provided that presents the various valid choices that are available to the end-user.