1. A computer program product comprising one or more computer-readable storage devices having thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following: an act of accessing one or more claims having an expression regarding a requesting entity, the claim originating from a claim issuer; an act of evaluating the expression of at least one of each of the one or more claims; an act of assigning the requesting entity to one or more identities based on the evaluation of the expression of the claim as well as a determination of the claim issuer; determining the assigned one or more identities correspond to a single group identity that includes a plurality of different identities, the group identity representing the aggregate of the plurality of identities, such that membership in the group identity is based upon determining that the requesting entity has been assigned to at least one identity that is part of the plurality of identities; an act of identifying an access policy according to the group identity, the access policy specifying an action and a permission status corresponding to one or more resources belonging to a relying party; for each of at least one of the one or more corresponding resources, an act of identifying role information corresponding to one or more roles that, if held by the requesting entity, would cause a provider of the corresponding resource to enforce the permission status for the action should the requesting entity request to perform the action on the corresponding resource; and an act of constructing a security token that indicates the role information for each of the at least one of the corresponding one or more resources.