1. A computer implemented method, comprising: generating a disjunction of application names based on manifests associated with one or more applications and a publisher for each of the one or more applications; receiving a request for a resource from a principal associated with a requesting application; retrieving an access control pattern associated with the resource; identifying a privilege sub-expression in the access control pattern; expanding the privilege sub-expression in the access control pattern with the disjunction of application names; and matching the expanded access control pattern to the principal name.