1. A method of performing an action on an object in a cloud computing environment having a plurality of computing nodes, the method comprising: determining a policy path from at least one permission within a policy of a customer; determining a first delegation path from within the determined policy path, the first delegation path being directed to at least one object permission for the object upon which the action is to be performed; and assigning an authorized user from a second delegation path from within the determined policy path, the second delegation path being directed to at least one user permission for the action to be performed.