Controlling access to resources by hosted entities

A method for including context in an access policy on a computing device, the method comprising:

• storing, by at least one processor in a memory area, a policy set specifying an application program identifier of an application program executing on the computing device, a resource identifier for a resource associated with the computing device, and access rights, wherein the application program identifier or the resource identifier includes an entity identifier associated with an entity, wherein the access rights define access by the entity to the resource, the memory area further storing a browser token and a location framework token, the browser token including the application program identifier and the location framework token including the resource identifier;
• receiving, by at least one processor, a request for the access rights by the entity to the resource;
• providing, by at least one processor, the received request to a user to input an authorization or a denial of the access rights;
• receiving, by at least one processor, a response associated with the authorization or the denial of the access rights from the user, the response including the entity identifier, wherein the access rights are granted when the received response comprises the authorization for the access rights, and wherein the entity identifier is combined with the application program identifier or the resource identifier into a single identifier;
• associating, by at least one processor, the received response and the single identifier with the browser token or the location framework token to create the policy set;
• and
• storing, by at least one processor, the created policy set in the memory area.

One or more storage devices embodying computer-executable instructions that when executed by at least one processor cause the at least one processor to perform operations for including context in an access policy on a computing device, the operations comprising:

• storing, by at least one processor in a memory area, a policy set specifying an application program identifier of an application program executing on the computing device, a resource identifier for a resource associated with the computing device, and access rights, wherein the application program identifier or the resource identifier includes an entity identifier associated with an entity, wherein the access rights define access by the entity to the resource, the memory area further storing a browser token and a location framework token, the browser token including the application program identifier and the location framework token including the resource identifier;
• receiving, by at least one processor, a request for the access rights by the entity to the resource;
• providing, by at least one processor, the received request to a user to input an authorization or a denial of the access rights;
• receiving, by at least one processor, a response associated with the authorization or the denial of the access rights from the user, the response including the entity identifier, wherein the access rights are granted when the received response comprises the authorization for the access rights, and wherein the entity identifier is combined with the application program identifier or the resource identifier into a single identifier;
• associating, by at least one processor, the received response and the single identifier with the browser token or the location framework token to create the policy set;
• and
• storing, by at least one processor, the created policy set in a memory area.