Methods and apparatus, including computer program products, for authorization controlled searching. In general, a search request is received, a database data structure is searched where the data structure is populated with records that include data and criteria for authorization to access the data, and a set of results is presented to a user, where the set of results includes data from the data structure for which a user is authorized the criteria is used to determine which results to include in the set of results. The criteria for authorization to access the data may be simple or complex, and may be based on a formation of associations from multiple layers of associations.