A setting apparatus sets any of authorization for and prohibition of access to data with a hierarchical structure. The setting apparatus includes: an object selection unit for selecting at least one object from a plurality of objects constituting the hierarchical structure; a pattern selection unit for selecting at least one pattern from a plurality of patterns, each of which determines a relative position in the hierarchical structure to the object selected by the object selection unit; and an access control policy setting unit for setting any of authorization for and prohibition of access to the object selected by the object selection unit and each of objects at the relative position to the selected object, which relative position is determined by the pattern selected by the pattern selection unit.