A system for resolving credentials for a device, comprising: at least one processor; a credentials data store used to store device credentials; a memory device including instructions that, when executed by the at least one processor, cause the system to: receive device credentials that include authentication credentials used by a group of devices and a device policy document to be managed by a service provider, wherein the authentication credentials are used to authenticate a device configured to communicate via a network with resources provided by the service provider; the device policy document includes a parameter that is updatable to include a device attribute for the device; the parameter is associated with a policy condition, that when satisfied, authorizes performance of a resource action requested by the device; and the device policy document is linked to the authentication credentials allowing devices that use the authentication credentials to share the device policy; receive a message from the device requesting that a managed service perform an action, wherein the device is in network communication with the managed service provided by the service provider and the message includes the authentication credentials for the device; authenticate the device using the authentication credentials; obtain the device policy document linked to the device from the credentials data store; update the parameter in the device policy document with the device attribute for the device; determine that the policy condition is satisfied to allow the device to request performance of the action; and authorize the request to be sent to the managed service to perform computing services. at least one processor; a credentials data store used to store device credentials; a memory device including instructions that, when executed by the at least one processor, cause the system to: receive device credentials that include authentication credentials used by a group of devices and a device policy document to be managed by a service provider, wherein the authentication credentials are used to authenticate a device configured to communicate via a network with resources provided by the service provider; the device policy document includes a parameter that is updatable to include a device attribute for the device; the parameter is associated with a policy condition, that when satisfied, authorizes performance of a resource action requested by the device; and the device policy document is linked to the authentication credentials allowing devices that use the authentication credentials to share the device policy; receive a message from the device requesting that a managed service perform an action, wherein the device is in network communication with the managed service provided by the service provider and the message includes the authentication credentials for the device; authenticate the device using the authentication credentials; obtain the device policy document linked to the device from the credentials data store; update the parameter in the device policy document with the device attribute for the device; determine that the policy condition is satisfied to allow the device to request performance of the action; and authorize the request to be sent to the managed service to perform computing services. receive device credentials that include authentication credentials used by a group of devices and a device policy document to be managed by a service provider, wherein the authentication credentials are used to authenticate a device configured to communicate via a network with resources provided by the service provider; the device policy document includes a parameter that is updatable to include a device attribute for the device; the parameter is associated with a policy condition, that when satisfied, authorizes performance of a resource action requested by the device; and the device policy document is linked to the authentication credentials allowing devices that use the authentication credentials to share the device policy; receive a message from the device requesting that a managed service perform an action, wherein the device is in network communication with the managed service provided by the service provider and the message includes the authentication credentials for the device; authenticate the device using the authentication credentials; obtain the device policy document linked to the device from the credentials data store; update the parameter in the device policy document with the device attribute for the device; determine that the policy condition is satisfied to allow the device to request performance of the action; and authorize the request to be sent to the managed service to perform computing services.