Patent ID: 8769642

Claim:
A computer-implemented method for providing access to one or more computing resources, comprising: under the control of one or more computer systems configured with executable instructions, receiving, by a computer system of the one or more computer systems, the computer system comprising one or more computing devices, information specifying one or more permissions for accessing the one or more computing resources, the one or more permissions having been specified by a delegator; generating, by the computer system, credential information that encodes the specified one or more permissions such that the specified one or more permissions are identifiable from the credential information and are consistent with a policy set maintained independently from the generated credential information that allows the delegator to provide to a delegatee access to the one or more computing resources, the policy set being modifiable after generating the credential information to revoke access to the one or more computing resources by the delegator causing delegation of the specified one or more permissions by the delegator to conflict with the policy set or to revoke the delegator's ability to delegate the access to the one or more computing resources to the delegatee; receiving, by the computer system, the generated credential information from the delegatee that is different from received credential information from the delegator in connection with a request to access the one or more computing resources; determining, by the computer system, based at least in part on the permissions encoded by the received generated credential information and at least in part on the policy set, whether to provide to the delegatee the access to the one or more computing resources, wherein determining to provide the access to the one or more computing resources to the delegatee is contingent on at least a determination that the policy set still allows the delegator to delegate the access to the one or more computing resources to the delegatee; and when determined to provide to the delegatee the access to the one or more computing resources, providing to the delegatee, by the computer system, the access to the one or more computing resources.