Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
This office action is responsive to amendment received on 7/14/2026. No claims are amended or added. Claims 1-20 are pending.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Step 2A, Prong One. Claim 1 recites maintaining a data store and verification rules, receiving an electronic request to perform data operation, determining whether the data object is protected, receiving approvals from authorized entities, determining whether a threshold number of approvals has been met, marking the request as approved, and automatically executing the request based on an auto-execution flag that bypasses certain credential verification steps. These steps collectively describe managing and executing a request based on rule-based authorization and multi-party conditions. These steps are similar to certain methods or organizing human activity, including managing permissions, approvals, and authorization processes. The claimed operations also include evaluating conditions, comparing credentials, counting approvals, and determining whether a threshold has been met, which are mental processes that could be processed in the human mind or using pen and paper. Therefore, claim1 recites an abstract idea.
Step 2A, Prong Two. The claim recites generic computer elements such as: electronically a data store, electronically maintaining verification rules, receiving electronic approvals, making a request as approved, and executing the request automatically. These elements merely implement the abstract authorization and approval process on generic computing components. The claim does not any specific improvement to computer functionality or specific technical improvement to network or data processing operations. Instead, the computer is used as a tool to perform the abstract authorization workflow more efficiently. Using generic computer components to automate an approval process does not integrate the abstract idea into a practical application.
Step 2B: The additional elements of the claim considered individually and in combination, amount to no more than maintaining data in a data store, applying stored rules, comparing credentials, counting approvals, setting an approval state and executing a request when conditions are met. These are routine data processing and access control functions commonly performed in software systems. The claim does not recite unconventional computer components or any non-conventional arrangement of elements that amount to significantly more than the abstract idea itself.
Response to Arguments
Applicant's arguments filed regarding Claim Rejections 35 USC § 101 have been fully considered but they are not persuasive.
The applicant argues that:
The claims are directed to computer-implemented security control protected data-object manipulation, not to a disembodies approval practice. Citing specification paragraphs 0003-0004, 0034 and 0035, 0039, 0043 and 0044. The multi -admin verification (MAV) rules, addresses security gaps.
Step 2A, the examiner analysis gives insufficient weight to the claimed auto- execution control logic. The claims define a specific computer security interlock governing when a protected data operation manipulate a data object in the data store. The claims are rooted in computer security and improve protection of computer stored data against unauthorized activity.
Response.
The applicant argues that the claims are directed to computer implemented security controls for protecting manipulation of data objects and not to a disembodies approval practice, citing paragraphs (0003) -(0004), (0034) -(0035), (0039), and (0043) -(0044) of the specification. Applicant further argues that the claimed multi-admin verification (MAV) rules address security gaps left by RBAC and MFA techniques.
These arguments have been considered but are not persuasive. The claims are directed to an abstract idea of managing and executing a request based on a rule-based authorization and multi-party conditions. The claims recite maintaining verification rules, receiving a request to perform a data operation, identifying a rule associated with the requested operation, receiving approvals from authorized entities, determining whether a threshold number of approvals has been satisfied., making the request as approved, and automatically executing the request under specified conditions. Such limitations recite evaluation and application of security policies governing access to information and therefore fall within the category or methods of organizing human activity and mental processes. Although he claims are implemented in a computing environment involving a data store and user credentials, merely limiting the abstract idea to a particular technological environment does not make the claims non-abstract. The cited portions of the specification describe the alleged improvement as addressing security gaps in existing authorization techniques, such as RBAC and MFA, by requiring multiple approvals and restricting who may approve or execute a request. See paragraphs 0039-0044. However, the specification attributes this the supposed improvement tot eh application of additional approval rules and restrictions rather than to any improvement in the functioning of the computer, data store, authentication mechanism or network itself. The claims do not recite new data storage architecture, a new authentication protocol, or any improvement tot eh underlying operation of computer technology.
The applicant further argues that examiner’s analysis gives insufficient weight to the claimed auto-execution control logic and that the claims define a specific computer security interlock governing when a protected data operation may manipulate a data object in the data store.
This argument is not persuasive. The additional limitations directed to an auto-execution flag and the bypass executor credential verification simply define conditions under which the claimed authorization workflow continues. The auto-execution logic determines whether particular verification steps are performed after the threshold approval requirement has been satisfied. Such limitations amount to additional rules governing the execution of a request and do not integrate the judicial exception into a practical application.
The claims recite the desired result of permitting or preventing execution of a request based on satisfaction of specified approval condition but do not recite any technological mechanism that improves the functioning of the data store itself or any other computer technology. Rather, the claims employ generic computing components t carry out the abstract idea of multi-party authorization and conditional execution. Accordingly, the claims remain directed to an abstract idea without reciting additional elements that amounts to significantly more than the judicial exception. Therefore, the rejection under 35 U.S.C. 101 is maintained.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SARGON N NANO whose telephone number is (571)272-4007. The examiner can normally be reached 7:30 AM-3:30 PM. M.S.T..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas Taylor can be reached at 571 272 3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SARGON N NANO/Primary Examiner, Art Unit 2443
