A method of applying network resource access policy, the method comprising: receiving by a filter comprised in a policy service , from a user agent , a request for a remote network resource, the request capable of containing authorization data specific to the remote network resource; obtaining from the request authorization data specific to the remote network resource when the request contains the authorization data; determining a resource access policy for the request by a policy server comprised in the policy service , including using the authorization data, if obtained, to determine the resource access policy for the request; applying the resource access policy to allow or deny access by the user agent to the remote network resource; when denying access to the remote network resource, redirecting the user agent to an authorization portal , wherein the user agent receives a response from the authorization portal , the response bypassing the policy service ; obtaining an authorization token by the user agent from an authorization at the authorization portal , receiving from the user agent by the filter an authorized request for the remote network resource, the authorized request including the authorization token; and in response to receiving the authorized request including the authorization token, storing the authorization data specific to the remote network resource at the user agent and redirecting the user agent to the remote network resource hosted on a content source to cause the user agent to make another request for the remote network resource and to receive an authorized response from the content source , the authorized response bypassing the policy service . receiving by a filter comprised in a policy service , from a user agent , a request for a remote network resource, the request capable of containing authorization data specific to the remote network resource; obtaining from the request authorization data specific to the remote network resource when the request contains the authorization data; determining a resource access policy for the request by a policy server comprised in the policy service , including using the authorization data, if obtained, to determine the resource access policy for the request; applying the resource access policy to allow or deny access by the user agent to the remote network resource; when denying access to the remote network resource, redirecting the user agent to an authorization portal , wherein the user agent receives a response from the authorization portal , the response bypassing the policy service ; obtaining an authorization token by the user agent from an authorization at the authorization portal , receiving from the user agent by the filter an authorized request for the remote network resource, the authorized request including the authorization token; and in response to receiving the authorized request including the authorization token, storing the authorization data specific to the remote network resource at the user agent and redirecting the user agent to the remote network resource hosted on a content source to cause the user agent to make another request for the remote network resource and to receive an authorized response from the content source , the authorized response bypassing the policy service . <EOS>