1. A computer-implemented method, comprising: receiving, on behalf of a user, a first request for access to resources in a resource hierarchy; applying, based at least in part upon permission data for the request, a first representation of a first security policy controlling access to the resources, the first representation expressed using a first policy language; storing the permission data to a data store in the resource hierarchy; receiving, on behalf of the user, a second request to access additional resources in the resource hierarchy; retrieving one or more additional security policies for the second request and based at least in part upon the permission data, the one or more additional security policies expressed in a second policy language; generating a second representation of the first security policy by translating the first representation of the first security policy from the first policy language to the second policy language, the second representation modifying a scope of authority of the user granted by the first representation of the first security policy; and applying the second representation, of the first security policy, and the one or more additional security policies to determine whether to grant access to the additional resources in the resource hierarchy.