1. A method comprising: building, at a target system controlling access to a resource, a context of a principal independently of the principal requesting access to the resource; and applying, at the target system, an authorization policy to the context to determine whether the principal is permitted to access the resource.