1. In a distributed system configured to exchange messages between computing systems, wherein authentication between two applications on different computing systems has been established, a method of maintaining a secure conversation between the two applications using a security context token, without having to have executable code in either application for obtaining the security context token, the method comprising acts of: receiving a message from a client application, the message to be sent to a service application in a communication session as part of an established security context; accessing a policy corresponding to the client application, the policy including a declarative policy assertion for determining that communication session messages sent to the service application should be communicated using a security context token associated with a base token used in establishing the security context; based on information within the policy, requesting the security context token, the request including information for identifying the base token; receiving the requested security context token in response to the request; and using the security context token for securing the message prior to sending it to the service application.