1. An authorization system, comprising: an authorization node executing an authorization policy; and a reference monitor arranged to receive from a first entity a request for access to a resource and a credential statement comprising a delegation of authority over a fact to a further entity, wherein the authorization node is arranged to determine whether the further entity consents to provide the fact to the first entity, and, responsive thereto, evaluate the request for access in accordance with the authorization policy and the credential statement.