1. A method of controlling access to information in an organization in response to requests for information, comprising: structuring organizational data of the organization into domains, wherein the domains contain charts, metadata, security roles, and role assignment rules, and wherein the charts comprise containers for subsets of the organizational data; structuring the organizational data within a chart in accordance with a hierarchical relationship of entities in the organization, wherein each entity of the organization is represented as a box in the chart, and other related entities are linked to the box; defining users identified by authentication credentials through one of: a static definition, and user information received from an external source with each request; mapping user records to corresponding principal boxes in the charts using chart user ID values that are defined in user records; defining roles using structural and box-level conditions, wherein a role defines a record-level and field-level data access control configuration; statically granting the roles to the users by explicitly configuring a link between a user record and a corresponding role; and defining role assignment rules to dynamically grant roles to a requesting user by identifying principal boxes for the users within a chart, and running the role assignment rules on the identified principal boxes.