1. An apparatus comprising: a memory operable to store a plurality of tokens, wherein the plurality of tokens comprises a plurality of risk tokens, each risk token representing a risk rating, the risk rating being a numerical value indicating a risk associated with granting a particular user access to a particular resource; a processor operable to: monitor a user session to identify a plurality of transactions performed by the particular user; store a token for each transaction of the plurality of transactions performed by the particular user during the user session; apply a risk combination rule that specifies which risk tokens are related to one another to identify a set of related risk tokens comprising at least a first risk token associated with a first action and a second risk token associated with a second action, the first action comprising a previously performed withdrawal from a first account by the particular user, the second action comprising a previously performed withdrawal from a second account by the particular user, the set of related risk tokens comprising the set of risks associated with a set of transactions that are related to one another within the plurality of transactions performed by the particular user during the user session; generate a composite risk token that represents an arithmetic combination of at least the first risk token associated with the previously performed withdrawal from the first account by the particular user and the second risk token associated with the previously performed withdrawal from the second account by the particular user; and use the composite risk token that represents the arithmetic combination of at least the first risk token associated with the previously performed withdrawal from the first account by the particular user and the second risk token associated with the previously performed withdrawal from the second account by the particular user to facilitate the making of an access decision associated with a request for a withdrawal by the particular user from third account.