1. A controller for privacy management in an identity network for at least one principal, wherein the identity network comprises a computer network including at least an identity provider, a discovery service provider, and a second service provider with which the principal can make transactions, and wherein a principal comprises a system entity whose identity can be authenticated, the controller comprising: a querying circuit configured to query the discovery service provider of the identity network to obtain identity resource information regarding identity resources available in the identity network and associated with the principal's identity, wherein an identity resource comprises data related to an identity or group of identities, or a service associated with an identity or group of identities; a first receiver configured to receive, from the discovery service provider, addressing information usable for addressing attributes of the identity resources available in the identity network and associated with the principal's identity; and an interacting circuit configured to interact, based on the received addressing information, with the second service provider to create, read, modify, or delete a privacy attribute governing the use of an identity resource available in the identity network and associated with the principal's identity; wherein the privacy attribute specifies permissions associated with the identity resource with respect to operations that may be performed by system entities on, or in relation to, the identity resource; and wherein the querying circuit, the first receiver, and the interacting circuit comprise separate circuits within the controller.