33. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of: receiving at an access server an identification of a resource, said identification including an absolute portion and a query portion; using said query portion to identify a first access rule from a plurality of access rules stored at said access server; determining whether access to said resource is authorized based on said identification of said resource without granting authorization to said resource, said determining including accessing said first access rule for said resource and accessing an identity profile for a first user to determine whether at least a portion of said first access rule is satisfied based on information in said identity profile, wherein said first access rule is not part of said identity profile; and allowing access to said resource, said step of allowing access is not performed if said first access rule is not satisfied.
33. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of: receiving at an access server an identification of a resource, said identification including an absolute portion and a query portion; using said query portion to identify a first access rule from a plurality of access rules stored at said access server; determining whether access to said resource is authorized based on said identification of said resource without granting authorization to said resource, said determining including accessing said first access rule for said resource and accessing an identity profile for a first user to determine whether at least a portion of said first access rule is satisfied based on information in said identity profile, wherein said first access rule is not part of said identity profile; and allowing access to said resource, said step of allowing access is not performed if said first access rule is not satisfied. 39. One or more processor readable storage devices according to claim 33 , wherein: said step of using said query portion includes determining whether said query portion includes a set of variables in a predetermined order; and said step of determining whether said query portion includes a set of variables in a predetermined order includes evaluating wildcards.