1. A method, comprising: detecting a request by a principal for access to a resource, wherein access is conditioned on a status of a role associated with the request, the principal, and the resource; evaluating a constraint associated with the role to determine the status; and providing the status to a context manager, which decides whether to provide access to the resource for purposes of satisfying the request.