Still another advantage of the present invention is that the hybrid system is designed to enforce complex conditions other than user or group identity through the use of a software module that interprets the conditions and decided whether to grant or deny access to the protected data asset.