The formulation of a security token that specifies role information corresponding to one or more roles of a requesting entity that is to request an action to be performed on a resource. The formulation begins by accessing one or more claims, each having an expression regarding the requesting entity. The expression for at least one of the claims is evaluated to thereby assign the requesting entity to one or more identities. The identities are then used determine role information to include in a role-based security token that may be submitted to the computing system that manages the resources.