1. A method of controlling access to a computer system, the method comprising: receiving user identification information corresponding to a user; retrieving a set of access policies corresponding to the user; generating, based on the access policies, at least one access rule for each of a plurality of security system sublayers; distributing each generated access rule to each of the security system sublayers; receiving, from the user, a request to access a computer system resource; and determining whether the user is permitted to access at least a portion of a computer system resource based on the user identification information and each of the generated access rules.