1. A method operable by a data processing system for identifying purpose and behavior of run time security objects, the method comprising: detecting, by the data processing system, a security object at run time, wherein the security object includes security attributes of a user; examining, by the data processing system, the security object for a token interface implementation; determining, by the data processing system, a purpose and behavior of the security object based on the token interface implementation, wherein determining the purpose and behavior of the security object includes determining whether the token interface implementation implements one of a set of token interfaces, wherein the set of token interfaces extends from a default token interface and wherein the default token interface includes a set of methods implemented by the security object for identifying the security object and managing security attributes stored in the security object; and handling, by the data processing system, the security object according to the purpose and behavior of the security object, wherein the security object is a token generated at run time by a service provider that receives a request for a service from the user, wherein the token is associated with a subject stored in a cache of the data processing system, wherein the subject represents the user, and wherein the subject stored in the cache of the data processing system includes at least two of the security objects generated at run time by the service provider.