1. In a distributed system configured to exchange messages between computing systems, wherein a security context between two applications on different computing systems has been established utilizing a base token, a method of maintaining a secure conversation between the two applications using a security context token, without having executable code in either application for obtaining the security context token, the method comprising: a step for authenticating a security context between a client application and a service application to establish a communication session; an act of intercepting a message from a client application located at a first computing system, wherein the message is intended for a service application located at a second computing system, the first and second computing systems in a communication session as part of a previously established security context represented by the base token and wherein the message is intercepted by a policy engine distinct from the client application and the service application; an act of the policy engine accessing a policy corresponding to the client application, the policy including a declarative policy assertion indicating that communication session messages sent from the client application to the service application should be communicated using a security context token associated with the base token originally used in establishing the communication session security context; an act of the policy engine requesting the security context token from the service application based on information within the policy, the request including information for identifying the base token used in establishing the communication session security context; the policy engine receiving the requested security context token in response to the request, wherein the requested security token is generated at an application remotely located from the policy engine in response to the request; and the policy engine using the received security context token for securing the message received from the client application prior to sending it to the service application.