43. An access server, comprising: a communication interface; one or more storage devices; and one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to perform a method comprising the steps of: receiving at said access server an identification of said resource, said identification including an absolute portion and a query portion, using said query portion to identify a first access rule from a plurality of access rules stored at said access server, determining whether access to said resource is authorized based on said identification of said resource without granting authorization to said resource, said determining including accessing said first access rule for said resource and accessing an identity profile for a first user to determine whether at least a portion of said first access rule is satisfied based on information in said identity profile, wherein said first access rule is not part of said identity profile, and allowing access to said resource, said step of allowing access is not performed if said first access rule is not satisfied.
46. The access server according to claim 43 , wherein: a set of resources are associated with a first policy domain; said policy domain includes one or more policies; said one or more policies includes a first policy; said first policy includes said first access rule; and said step of using said query portion includes the steps of: identifying said first policy domain using said absolute portion, and identifying said first policy using said query portion.