1. An attestation system in a cloud computing environment, comprising: an authorization system comprising a physical processor, the authorization system to: receive first attestations and second attestations issued by users and by applications of the cloud computing environment, each of the first attestations specifying attributes of a user or application, and each of the second attestations specifying that a respective subject is authorized to perform an action on a respective resource, and each of the second attestations containing an identifier of a respective issuer of the corresponding second attestation; control access to the first and second attestations; receive at least one query from a requesting user or application of the cloud computing environment, the at least one query including information identifying issuers trusted by the requesting user or application; and in response to the at least one query: select a second attestation, from the second attestations, that has an identifier of one of the issuers identified by the information, and determine, based on at least one of the first attestations, whether the requesting user or application has a specified attribute, and determine, based on at least the selected second attestation, whether the requesting user or application has a right to access a specified resource.