1. At a computer system, a method for securing a resource store, the method comprising: an act of receiving policy information for the resource store; an act of deriving permissions for accessing secured resources in the resource store from the received policy information, the permissions defining secured operations that can be performed on secured resources in the resource store based on received identity information, the permissions derived from: a secured operations table defining the secured operations that are possible for the resource store; a secured resources table defining the secured resources within the resource store, each secured resource being of a specified resource type, from among a plurality of different resource types; and each of the plurality of different resource types defined in a secured resource types table; an act of receiving identity information for a session connected to the resource store, the identity information accumulated from one or more claims submitted to the resource store on behalf of the session; an act of determining the resource types that the session can access based on the derived permissions and the received identity information; an act of accessing a metadata table that maps secured resource identifiers to corresponding resource types; and an act of filtering metadata table into a subset of metadata that includes resource identifiers for secured resources of the resource types the session can access.