1. A method, comprising: receiving an authorization request to invoke an application for a user, the authorization request comprising a set of tokens characterizing the application; obtaining a policy profile; making a policy decision according to the policy profile and the set of tokens; modifying the set of tokens based on the policy decision to yield a modified set of tokens; and communicating an authorize message comprising the modified set of tokens to facilitate invocation of the application according to the modified set of tokens.