A computer-implemented method performed by a system, the method comprising: receiving, from an entity, a first request to create a first session to permit access to resources of a provider network (100, 800, 900), the first request including a first one or more attributes and an identification of a role to assume by the entity for the first session, wherein the first one or more attributes include a user-specified attribute; evaluating the first one or more attributes against a first set of rules that govern whether the role can be assumed by the entity to determine whether to grant the first request, the first set of rules including a first rule identifying a set of attributes that cannot be user-specified; and when it is determined to grant the first request: permitting the request and generating first session data including the user-specified attribute; receiving, from the entity, a second request to perform an action with a resource hosted by the provider network (100, 800, 900); obtaining the user-specified attribute from the first session data based at least in part on the second request; evaluating the first one or more attributes and at least one attribute associated with the resource against a second set of rules that govern whether the action can be performed to determine whether to grant or deny the second request, the second set of rules including a second rule specifying that a value of the user-specified attribute must match a value of an attribute associated with the resource; and when it is determined to grant the second request, permitting the second request and performing the action by the resource, wherein the first session data includes the user-specified attribute in place of another attribute included in the first one or more attributes, and wherein the user-specified attribute and the other attribute share a key name. receiving, from an entity, a first request to create a first session to permit access to resources of a provider network (100, 800, 900), the first request including a first one or more attributes and an identification of a role to assume by the entity for the first session, wherein the first one or more attributes include a user-specified attribute; evaluating the first one or more attributes against a first set of rules that govern whether the role can be assumed by the entity to determine whether to grant the first request, the first set of rules including a first rule identifying a set of attributes that cannot be user-specified; and when it is determined to grant the first request: permitting the request and generating first session data including the user-specified attribute; receiving, from the entity, a second request to perform an action with a resource hosted by the provider network (100, 800, 900); obtaining the user-specified attribute from the first session data based at least in part on the second request; evaluating the first one or more attributes and at least one attribute associated with the resource against a second set of rules that govern whether the action can be performed to determine whether to grant or deny the second request, the second set of rules including a second rule specifying that a value of the user-specified attribute must match a value of an attribute associated with the resource; and when it is determined to grant the second request, permitting the second request and performing the action by the resource, permitting the request and generating first session data including the user-specified attribute; receiving, from the entity, a second request to perform an action with a resource hosted by the provider network (100, 800, 900); obtaining the user-specified attribute from the first session data based at least in part on the second request; evaluating the first one or more attributes and at least one attribute associated with the resource against a second set of rules that govern whether the action can be performed to determine whether to grant or deny the second request, the second set of rules including a second rule specifying that a value of the user-specified attribute must match a value of an attribute associated with the resource; and when it is determined to grant the second request, permitting the second request and performing the action by the resource, wherein the first session data includes the user-specified attribute in place of another attribute included in the first one or more attributes, and wherein the user-specified attribute and the other attribute share a key name.