19. The one or more computer-readable memories of claim 1 , said determining that said first answer set is not subsumed by said second answer set comprising: determining whether the number of abduced assertions in the first answer set is greater than the number of abduced assertions in the second answer set; and determining whether a substitution exists such that: the first answer set is logically equivalent to the second answer set when variables in said first answer set and said second answer set are substituted according to the substitution; and the first set of one or more assertions is a superset of the second set of one or more assertions when variables in said first answer set and said second answer set are substituted according to the substitution.
1. One or more computer-readable memories having stored thereon executable instructions to perform a method of facilitating access to a resource, the method comprising: abducing a first set of one or more assertions from information that comprises an access request for a first principal to access the resource, a system that performs said abducing not having in possession said first set of one or more assertions, said abducing being performed by acts comprising: receiving a first answer set and a second answer set, said first answer set comprising said first set of one or more assertions, said second answer set comprising a second set of one or more assertions, said first set of said one or more assertions and said second set of said one or more assertions each satisfying a condition that either said first set of one or more assertions or said second set of one or more assertions will, when presented to a guard of the resource, cause said guard to find that a query evaluates to true under a policy implemented by said guard; and determining that said first answer set is not subsumed by said second answer set; receiving a template that specifies said first set of one or more assertions; obtaining a first token that satisfies a first one of said first set of one or more assertions; presenting, to said guard, (a) a set of one or more tokens that comprises said first token, and (b) said access request; receiving access to said resource from said guard; and accessing said resource.