The AAF Groups tool extends user identity allowing access control decisions to be made against defined authorization policies by multiple application stacks.