1. One or more computer-readable memories having stored thereon executable instructions to perform a method of facilitating access to a resource, the method comprising: abducing a first set of one or more assertions from information that comprises an access request for a first principal to access the resource, a system that performs said abducing not having in possession said first set of one or more assertions, said abducing being performed by acts comprising: receiving a first answer set and a second answer set, said first answer set comprising said first set of one or more assertions, said second answer set comprising a second set of one or more assertions, said first set of said one or more assertions and said second set of said one or more assertions each satisfying a condition that either said first set of one or more assertions or said second set of one or more assertions will, when presented to a guard of the resource, cause said guard to find that a query evaluates to true under a policy implemented by said guard; and determining that said first answer set is not subsumed by said second answer set; receiving a template that specifies said first set of one or more assertions; obtaining a first token that satisfies a first one of said first set of one or more assertions; presenting, to said guard, (a) a set of one or more tokens that comprises said first token, and (b) said access request; receiving access to said resource from said guard; and accessing said resource.
5. The one or more computer-readable memories of claim 1 , wherein said template specifies a constraint on a variable involved in said first one of said first set of one or more assertions, said constraint being satisfiable with a set or range of values, and wherein the method further comprises: choosing one of said values to substitute in said variable based on a principle.