In various embodiments of the present invention, a facilitation token that includes authorization for a request manager to act on behalf of a resource is received from the request manager. A user-access token is also received from the request manager; the user-access token includes (i) a request, (ii) an identity of a user making the request, and (iii) permissions information. If the request is permitted by the resource, based on information in the facilitation token, the request is fulfilled.