Device authentication within deployable computing environment

A system for managing relationships in a deployable computing environment, comprising:

• an authenticator component configured to:
• create an identity resource representing a user within a deployable computing environment, the identity resource corresponding to a user identification ticket used to authorize the user to perform one or more user operations;
• create a device resource representing a device within the deployable computing environment, the device resource corresponding to a device identification ticket used to authorize the device to perform one or more device operations;
• and
• create a device claim resource representing a relationship between the user and the device, the device claim resource corresponding to a device claim ticket used to authorize the device to perform an authorized user operation on behalf of the user regardless of whether the user has authorized user operation via the user identification ticket, the authorized user operation not comprising the one or more device operations that the device is authorized to perform,
• at least some of the authenticator component implemented at least in part via a processing unit.

A tangible computer-readable storage medium comprising computer-executable instructions, which when executed at least in part via a processing unit on a computer performs acts, comprising:

• creating an identity resource representing a user within a deployable computing environment, the identity resource corresponding to a user identification ticket used to authorize the user to perform one or more user operations;
• creating a device resource representing a device within the deployable computing environment, the device resource corresponding to a device identification ticket used to authorize the device to perform one or more device operations;
• and
• creating a device claim resource representing a relationship between the user and the device, the device claim resource corresponding to a device claim ticket used to authorize the device to perform an authorized user operation on behalf of the user regardless of whether the user has authorized user operation via the user identification ticket, the authorized user operation not comprising the one or more device operations that the device is authorized to perform.