A security system (300, 700) for allowing a client to access a protected resource through an application container (308, 310, 312, 710), comprising: an application container, configured to access an access controller object provided by a security service (314, 716) for authorisation decisions, and configured to receive an access request from a client application (306, 702) to access a protected resource (320, 708), and to communicate said access request and a callback handler to the security service; context information comprising one or more pieces of information that make up the context of the request, comprising identity of the target protected resource, the values of the requests' parameters, and/or the values of profile attributes associated with the client; the security service (314, 716) configured to make a decision to permit or deny said access request; and, a resource interface for communicating permitted access requests to said protected resource; wherein said security service includes a plurality of access decision mechanisms (718, 720, 722) for defining an access policy and for each determining a contributory decision to permit, deny, or abstain from said access request in relation to a user identified by a token, and wherein said security service comprises the access controller object, the access controller object configured to transfer said access request to said plurality of access decision mechanisms along with the token, and to combine said contributory decisions into an overall decision by the security service to permit or deny said access request in dependence on an adjudication policy, wherein only in the case of an overall decision to permit will the access request be passed to the protected resource, wherein said access decision mechanisms are access decision plug-ins (718, 720, 722) which can be inserted into the security service without requiring a core architecture to be modified, and which are configured to use the callback handler to request the context information from the application container for the access request. an application container, configured to access an access controller object provided by a security service (314, 716) for authorisation decisions, and configured to receive an access request from a client application (306, 702) to access a protected resource (320, 708), and to communicate said access request and a callback handler to the security service; context information comprising one or more pieces of information that make up the context of the request, comprising identity of the target protected resource, the values of the requests' parameters, and/or the values of profile attributes associated with the client; the security service (314, 716) configured to make a decision to permit or deny said access request; and, a resource interface for communicating permitted access requests to said protected resource; wherein said security service includes a plurality of access decision mechanisms (718, 720, 722) for defining an access policy and for each determining a contributory decision to permit, deny, or abstain from said access request in relation to a user identified by a token, and wherein said security service comprises the access controller object, the access controller object configured to transfer said access request to said plurality of access decision mechanisms along with the token, and to combine said contributory decisions into an overall decision by the security service to permit or deny said access request in dependence on an adjudication policy, wherein only in the case of an overall decision to permit will the access request be passed to the protected resource, wherein said access decision mechanisms are access decision plug-ins (718, 720, 722) which can be inserted into the security service without requiring a core architecture to be modified, and which are configured to use the callback handler to request the context information from the application container for the access request.