Composite identity for accessing network-based services

A computing device for access management in a network-based service, the computing device comprising:

• a hardware processor;
• a memory, the memory storing instructions, which when executed by the hardware processor cause the computing device to perform operations comprising:
• identifying an action involving a first account used by a user to access resources;
• determining that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response:
• identifying an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account;
• determining, according to the policy, that the second account referenced in the identity data structure allows for taking the action;
• sending a transmission to a device of the user via the first account of the user, the transmission identifying the second account;
• receiving the transmission at the device of the user;
• selecting an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account;
• transmitting the access token to the server of the network-based service;
• receiving the access token from the device of the user;
• and
• responsive to validating that the access token received from the device of the user is valid and allows the action, causing performance of the action involving the user.

A machine-readable medium, storing instructions for access management in a network-based service, the instructions, which when executed, cause the machine to perform operations comprising:

• identifying an action involving a first account used by a user to access resources;
• determining that an account policy of the network-based service forbids performing the action for an account type of the first account, and in response:
• identifying an identity data structure corresponding to the user, the identity data structure identified using information from the first account, the identity data structure linking the first account with a second account, the second account of a different type of account than the first account;
• determining, according to the policy, that the second account referenced in the identity data structure allows for taking the action;
• sending a transmission to a device of the user via the first account of the user, the transmission identifying the second account;
• receiving the transmission at the device of the user;
• selecting an access token associated with the second account to complete the action, the access token selected by the device of the user from a plurality of access tokens held by the device, the access token signifying that the user is authenticated on the second account;
• transmitting the access token to the server of the network-based service;
• receiving the access token from the device of the user;
• and
• responsive to validating that the access token received from the device of the user is valid and allows the action, causing performance of the action involving the user.