6. A system according to claim 1 , wherein the reference monitor is further arranged to detect the presence of the delegation of authority and insert an additional condition requiring that the further entity consents to provide the fact to the first entity into the delegation of authority.
1. An authorization system, comprising: one or more hardware processors configured to provide an authorization node executing an authorization policy; and a reference monitor arranged to receive from a first entity a request for access to a resource and a credential statement, wherein the first entity consents to import a fact from a further entity, wherein the authorization node is arranged to determine whether the further entity consents to export the fact to the first entity, and, responsive thereto, evaluate the request for access in accordance with the authorization policy and the credential statement, the authorization node being further arranged to deny the access request received from the first entity in response to the further entity not consenting to export the fact to the first entity, wherein the request and credential statement are SecPAL statements, and the delegation of authority in the credential statement comprises a “can say” statement, and the further entity consents to provide the fact to the first entity using a SecPAL “can listen to” statement.