1. A computer implemented method, comprising: generating privilege access lists based on manifests associated with one or more applications and a publisher for each of the one or more applications, said generating including accessing a manifest associated with a first of the applications, identifying one or more privileges in the manifest that the first application is asserted to have, and confirming that a publisher of the first application may grant the privileges in the manifest to the first application; receiving a request for a resource from a principal associated with a requesting application; retrieving an access control pattern associated with the resource; identifying a privilege sub-expression in the access control pattern, the sub-expression defining a privilege; accessing the privilege access lists to determine which applications have the privilege in the sub-expression; expanding the privilege in the privilege sub-expression in the access control pattern to include the applications that have the privilege; and matching the expanded access control pattern to the name of the principal.