15. A system, comprising: at least one processor; and memory including instructions that, when executed by the at least one processor, cause the system to: receive a request to access one or more resources of a resource hierarchy; determine a first representation of a security policy controlling access to the one or more resources, the first representation expressed using a first policy language; obtain, in response to the request, a second representation of the security policy generated using a second policy language, the second representation modifying a scope of authority granted by the first representation; retrieve one or more additional security policies for the request, the one or more additional security policies expressed in the second policy language; and evaluate the one or more additional security policies and the second representation to determine whether to grant access to the one or more resources.
15. A system, comprising: at least one processor; and memory including instructions that, when executed by the at least one processor, cause the system to: receive a request to access one or more resources of a resource hierarchy; determine a first representation of a security policy controlling access to the one or more resources, the first representation expressed using a first policy language; obtain, in response to the request, a second representation of the security policy generated using a second policy language, the second representation modifying a scope of authority granted by the first representation; retrieve one or more additional security policies for the request, the one or more additional security policies expressed in the second policy language; and evaluate the one or more additional security policies and the second representation to determine whether to grant access to the one or more resources. 17. The system of claim 15 , wherein the instructions when executed further cause the system to: determine permission data for the request; and determine the one or more additional security policies based at least in part upon the permission data.