1. In a service-oriented environment comprising a plurality of services, a method for authenticating a client, the method comprising the steps: a client invoking a composite service, the composite service comprising a plurality of different services and different principles, wherein the principles are entities that invoke the different services of the composite service; maintaining state information comprising an identify of at least one service that is associated with the composite service; and using the state information to enforce access control on invocation of the at least one service, wherein at least a portion of the state information is stored in the form of a composite principle, wherein the composite principle comprises a temporally ordered sequence of the different principles that are responsible for nested invocation of the different services associated with the composite service, and wherein using the state information to enforce access control on invocation of the at least one service comprises: obtaining one or more rules that are used to determine if the client can invoke the composite service, wherein the one or more rules define access control policies which are specified using a pure-past linear temporal logic based specification language having past time temporal operators, and which support a temporal predicate on the composite principle; and processing the one or more rules against the composite principle to verify whether invocation of the composite service by the client satisfies the one or more rules.