also available for the inclusion into the decision context are items such as identity strength did the user authenticate with a simple password challenge or by a stronger method such as a thumbprint scan the network address the request originated from within the building from an internal network or over the internet or other like context information as known to those skilled in the art policies can be dynamically updated at any time as can user attributes within the identity repositories this allows an enormous amount of flexibility in creating and managing access control policies without incurring the old style burdens of acl and group membership when a policy changes the changed policy applies to all users immediately u2014 the next request processed will be evaluated against the new policy and the information needed to evaluate the request will be dynamically located and retrieved this provides an additional advantage in the form of what has come to be known as u201c single sign out u201d in which if an employee or user is terminated all of his abilities to access critical resources could be revoked by simply changing his employee status in the identity repository from u201c active u201d to u201c.