1. An apparatus comprising: a memory operable to: store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource; store a plurality of tokens indicating a user is using a device to request access to a resource over a network; and a processor operable to: receive a risk token indicating the risk associated with granting at least one of the user and the device access to the resource, the risk token computed from a set of tokens in the plurality of tokens; determine at least one token-based rule based at least in part upon the plurality of tokens and the risk token; make an access decision based upon the at least one token-based rule; and communicate a decision token representing the access decision.