According to one embodiment, an apparatus may store a plurality of token-based rules. The apparatus may further store a plurality of tokens. The apparatus may receive a first token indicating that access to a mainframe resource has been requested. The apparatus may determine at least one token-based rule based at least in part upon the first token. The at least one token-based rule may condition access to the resource upon a second token. The second token may be associated with a device. The second token may indicate a password. The second token may further indicate a geographic location associated with the device. The apparatus may determine that the plurality of tokens includes the second token generate a session token based at least in part upon the first token and the second.