According to one embodiment, an apparatus may receive a first token indicating that access to a resource has been requested by a device. The first token may further indicate that the resource is a confidential resource. The apparatus may determine that a plurality of tokens includes a second token and generate a session token based at least in part upon the first token and the second token in response to the determination that the plurality of tokens includes the second token. The apparatus may receive a third token indicating an event affecting the risk associated with granting access to the resource and determine, based at least in part upon the at least one token-based rule, that access to the resource should be terminated in response to receiving the third token. The apparatus may then terminate the session token in response to the determination that access to the resource should be terminated.