1. A method for implementing a self-describing authorization policy for resources provided by a cloud service, the method comprising the steps of: exposing resources provided by the cloud service as one or more meshes that are associated with a client; providing links to the resources in each of the one or more meshes, the links referring to other resources that are contained in a given mesh; and annotating the links between the resources with authorization requirements for accessing a resource expressed using claim tickets, the claim tickets containing assertions governing access to the resource and further being arranged to be presented with a principal ticket by the client when traversing the given mesh, the principal ticket being usable for authenticating the client.