Method and apparatus for token-based conditioning

A method for communicating an access control determination to a resource comprising:

• storing a plurality of tokens indicating a user is requesting access to a resource over a network, the plurality of tokens comprising a resource token indicating a form of authentication provided by the resource;
• determining, by a processor, at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising:
• an obligation to be fulfilled, the obligation comprising:
• a task to be performed in conjunction with accessing the resource, wherein the task indicates a peripheral device attached to the device should be removed before access may be granted;
• and
• a second task that is optional with respect to accessing the resource, the second task indicating synchronizing a system clock of the resource provider with a clock on the network;
• and
• a message providing instruction regarding how to fulfill the obligation, wherein the message further indicates a reason access to the resource was not granted;
• generating a decision token representing the at least one condition;
• and
• communicating, by the processor, the decision token to a resource provider to facilitate enforcement of the at least one condition.

One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

• store a plurality of tokens indicating a user is requesting access to a resource over a network, the plurality of tokens comprising a resource token indicating a form of authentication provided by the resource;
• determine at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising:
• an obligation to be fulfilled, the obligation comprising:
• a task to be performed in conjunction with accessing the resource, wherein the task indicates a peripheral device attached to the device should be removed before access may be granted;
• and
• a second task that is optional with respect to accessing the resource, the second task indicating synchronizing a system clock of the resource provider with a clock on the network;
• and
• a message providing instruction regarding how to fulfill the obligation, wherein the message further indicates a reason access to the resource was not granted;
• generate a decision token representing the at least one condition;
• and
• communicate the decision token to a resource provider to facilitate enforcement of the at least one condition.