1. A data processing system, comprising: a policy manager using an evidence based security model that evaluates multiple pieces of evidence using a security policy to determine a set of granted permissions; and an oracle for determining whether a first permission is granted based on a subset of the multiple pieces of evidence, the subset including less than all of the multiple pieces of evidence, wherein the policy manager, upon receiving a request for the first permission, queries the oracle to determine whether the first permission is granted based on the subset of the multiple pieces of evidence.