Patent ID: 8738791

Claim:
A method performed by a data processing apparatus, the method comprising: storing information defining a plurality of network policy groups, each network policy group having an associated policy location, an associated policy role, and one or more network usage policies that specify access permissions for resources available on a network; receiving first information indicating that a first client device operated by a user is connected to the network at a first physical location, and identifying a first user role associated with the user; identifying, from among the plurality of network policy groups, a first network policy group having both (i) an associated first policy location that corresponds to the first client device's first physical location, and (ii) an associated policy role that corresponds to the user's first user role; receiving, from the first client device while the first client device is associated with the first physical location, a first resource request to access a resource available on the network; regulating the first client device's access to resources available on the network based on the one or more network usage policies associated with the identified first network policy group by determining, while the first client device is associated with the first physical location and based on receiving the first resource request, first access permissions for the first client device to the requested resource based on the one or more network usage policies associated with the identified first network policy group; receiving second information indicating that a second client device operated by the user is connected to the network at a second physical location, and identifying a second user role associated with the user, the second physical location of the second client device different from the first physical location; identifying, from among the plurality of network policy groups, a second network policy group having both (i) an associated second policy location that corresponds to the second client device's second physical location, and (ii) an associated policy role that corresponds to the user's second user role; receiving, from the second client device while the second client device is associated with the second physical location, a second resource request to access the resource; and determining, while the second client device is associated with the second physical location and based on receiving the second resource request, second access permissions for the second client device to the requested resource based on the one or more network usage policies associated with the identified second network policy group.