Patent ID: 8001610

Claim:
A system comprising: one or more network resources coupled to a network; an endpoint device coupled to the network that provides a user access to the network resources; an agent that generates health information that represents a security state of the endpoint device, wherein the agent comprises a software module executing on the endpoint device; a controller that receives from the endpoint device identification information associated with the user and the health information generated by the agent, wherein the controller includes an authentication engine that authenticates the user and identifies a plurality of roles defined for the user, wherein each role of the plurality of roles corresponds to a membership in a group of users, wherein the controller includes a plurality of policies specifying roles that are to be excluded upon failure of health indicators, and wherein the controller generates access control information by applying the policies with the authentication engine to restrict the roles defined for the user by excluding a subset of the identified roles based on the health information of the endpoint device; and a protection device coupled to the network, wherein the protection device provides access to the network resources by the endpoint in accordance with the non-excluded roles identified for the user.