Patent ID: 7685632

Claim:
A computer-readable storage medium encoded with instructions that cause a computer to: provide a centralized policy store having policies for application programs, a policy for an application program specifying access rights of the application program to resources, wherein at least some application programs have different policies; receive a first request to load an application program into memory of the computer; responsive to receiving the first request, determining if there is a policy in the centralized policy store for the application program, when it is determined that there is no such policy, denying the first request to load the application program; and when it is determined that there is such policy, loading the application program into memory of the computer; subsequent to loading the application program, receiving a second request to access a resource of the computer, wherein the second request is received from a principal selected from the group consisting of the application program and a combination of a user identity and the application program; and performing an access control check based on the policy for the application program to determine whether to allow the requested access to the requested resource, wherein the policy for the application program is composed of one or more rules, the one or more rules having at least one dependency on a dynamically configurable environment parameter.