Abstract: Disclosed herein are exemplary embodiments of innovations in the area of encoding pictures or portions of pictures (e.g., slices, coding tree units, or coding units) and determining whether and how certain filtering operation should be performed and flagged for performance by the decoder in the bitstream. In particular examples, various implementations for setting the sample adaptive offset (SAO) syntax elements in the H.265/HEVC standard are disclosed. Although these examples concern the H.265/HEVC standard and its SAO filter, the disclosed technology is more widely applicable to other video codecs that involve filtering operations (particularly multi-stage filtering operations) as part of their encoding and decoding processes.

Abstract: The present disclosure provides systems and methods for user interaction and task completion using multiple devices. A set of devices may be used to perform a task, such that different devices may perform different steps of the task. A device management service may update state information at each device of the set, thereby enabling a user to interact with any of the computing devices to perform the task. A device management service may also automatically determine which device should be used by the user, based on task or step requirements, device characteristics, and device capabilities, among other examples. Thus, rather than being required to continue a task on the same device (even when the device is not well-suited for the current step or task), the user is provided with the option to use and, in some instances, is automatically transitioned to use, different devices within the set.

Abstract: A holographic data storage system comprises an emitter system, a holographic recording medium, and an input waveguide network formed of one or more multimode optical waveguides. The holographic recording medium has multiple recording regions, each optically coupled to a corresponding one of multiple out-coupling regions of the input waveguide network, the holographic data storage system arranged to persistently write data of an input beam, received at any one of the out-coupling regions, to the corresponding recording region. A controller is coupled to at least one of the emitter system and at least one controllable guiding element of the input waveguide network and controls at least one optical characteristic of the input beam or the at least one guiding element, so as to guide the input beam from an in-coupling region to any selected one of the multiple out-coupling regions. Similar waveguide networks are provided for carrying reference and output beams.

Abstract: A method of capturing video and audio information includes, at a server computer, determining a capture group that includes at least a first client device and a second client device. The method further includes receiving a group capture request and transmitting an individual capture request to at least the second client device. The method further includes receiving a first individual capture from the first client device and a second individual capture from the second client device, associating the first individual capture with the second individual capture in a group capture, and providing access to the group capture to at least one of the first client device and the second client device.

Abstract: A secure data path enables sending and receiving message applications to transmit instructions for recalling a sent message and updating or deleting content of the recalled message in an inbox of a recipient. In response to a recall request from the sending message application over the secure channel, since the receiving message application has access to a recipient inbox, the receiving message application may process the recall request to update and/or delete content of a received message—even after a recipient has read the received message. Since the content of a received message may be updated or deleted in a recipient inbox, robust and reliable message recall is provided.

Abstract: Embodiments described herein are directed to transferring the ownership of a computing device from one entity to another entity. For example, a security processor is utilized to boot the computing device. During a boot session, the security processor loads and executes boot code, which determines whether specialized firmware authorized by the current owner indicates whether a transfer of ownership is to occur. In response to determining that the specialized firmware indicates that a transfer of ownership is to occur, the secure processor loads and executes the specialized firmware. The specialized firmware, when executed, causes the security processor to program a set of fuses with the public key of the new owner. Execution of the specialized firmware also causes the security processor to invalidate the public key of the original owner, which is stored in another set of fuses.

Abstract: A computing device is disclosed that includes an organic light-emitting diode (OLED) display. The OLED display has a front surface and a back surface. The computing device includes a moveable display support connected to the back surface of the display. In some implementations, the moveable display support is configured to limit bending in one direction to a first bend radius and to limit bending in another direction to a second bend radius. In some implementations, the moveable display support is formed by a plurality of unit cells.

Abstract: In non-limiting examples of the present disclosure, systems, methods and devices for enabling real-time gestures on shared canvases are presented. A shared object service may be associated with a plurality of shared objects. A plurality of user accounts and/or client devices may be granted access to a shared object. Each client device that accesses the shared object may store a distributed data structure locally that corresponds to the shared object. When client devices perform operations associated with the shared object the operations are logged by the shared object service and timestamped. Those operations are then reported to the client devices, where cursor movements can be rendered in real time. If cursor movements and/or user input device operations associated with a cursor meet conditions for a gesture operation the cursor may be transformed to a gesture/animation and rendered on canvases of each connected client device.

Abstract: A unit test generation system employs a neural transformer model with attention to generate candidate unit test sequences given a focal method of a programming language. The neural transformer model is pre-trained with source code programs and natural language text and fine-tuned with mapped test case pairs. A mapped test case pair includes a focal method and a unit test case for the focal method. In this manner, the neural transformer model is trained to learn the semantics and statistical properties of a natural language, the syntax of a programming language and the relationships between the code elements of the programming language and the syntax of a unit test case.

Abstract: Examples that relate to calling on a computing device are disclosed. One example provides a computing device, comprising, a first display a second display, a sensor system a logic subsystem and a storage subsystem comprising instructions executable by the logic subsystem to output, via one or both of the first display and the second display, a notification of an incoming phone call at the computing device, and based on output from the sensor system indicating a relative angle between the first display and the second display being changed to an angle greater than a predetermined angle, answer the incoming phone call.

Abstract: Embodiments of the subject matter described herein relate to a wireless programmable media processing system. In the media processing system, a processing unit in a computing device generates a frame to be displayed based on a graphics content for an application running on the computing device. The frame to be displayed is then divided into a plurality of block groups which are compressed. The plurality of compressed block groups are sent to a graphics display device over a wireless link. In this manner, both the generation and the compression of the frame to be displayed may be completed at the same processing unit in the computing device, which avoids data copying and simplifies processing operations. Thereby, the data processing speed and efficiency is improved significantly.

Abstract: A method for simulating a quantum-capacitance response of a material configuration comprises (a) constructing a non-interacting Hamiltonian for the material configuration based on input data; (b) computing a natural-orbitals basis for each of a plurality of parts of the material configuration under the non-interacting Hamiltonian; (c) projecting the non-interacting Hamiltonian in the natural-orbitals basis to obtain a non-interacting quantum-mechanical description for each part; (d) constructing an interacting Hamiltonian by adding an electron-interaction term to the non-interacting Hamiltonian for each of the plurality of parts; (e) for each of a plurality of representative points in a sample space of at least one tunable parameter of the material configuration, using a sums-of-Gaussians procedure to assemble a basis of Gaussian states for approximating low-energy eigenstates of the material configuration under the interacting Hamiltonian; (f) for each of a plurality of vicinities of representative points in

Abstract: An organic light emitting diode (OLED) display system comprises an OLED array and a power management system that includes at least one voltage generator for the OLED array. A timing microcontroller comprises a decoder/encoder configured to receive HDR pixel data and output display pixel data. A portion of the HDR pixel data is sampled and a luminance index value of the sampled portion is determined, where the luminance index value corresponds to a maximum luminance of the sampled portion. The luminance index value is used to control the at least one voltage generator to reduce power consumption of the OLED display system.

Abstract: Some implementations disclosed herein provide techniques and arrangements to enable translating language characters in media content. For example, some implementations receive a user selection of a first portion of media content. Some implementations disclosed herein may, based on the first portion, identify a second portion of the media content. The second portion of the media content may include one or more first characters of a first language. Some implementations disclosed herein may create an image that includes the second portion of the media content and may send the image to a server. Some implementations disclosed herein may receive one or more second characters of a second language corresponding to a translation of the one or more first characters of the first language from the server.

Abstract: A data processing system implements a receiving a textual input comprising a query for a first image. The data processing system also implements analyzing the textual input to determine a predicted color palette associated with a subject matter of the query; and procedurally generating the first image using the predicted color palette. Another implementation of the data processing system implements providing the textual input to a first machine learning model to obtain the first image, the first machine learning model being trained using a dataset comprising abstract imagery and analyzing the textual input using the first machine learning model to obtain the first image in response to receiving the textual input.

Abstract: A technique is described herein for capturing signals that indicate when any calling BOT delegates control to a called BOT, or when a calling BOT is preconfigured to contact a called BOT (e.g., as conveyed by a manifest file associated with the calling BOT). The technique can leverage these signals to facilitate the selection of BOTs. For example, the technique can use the signals to improve searches performed by a search engine and/or recommendation engine. The technique can also use the signals to generate metadata items that describe the properties of the available BOTs.

Abstract: Systems and methods for providing color recommendations for content editing applications include receiving a color recommendation request from a content editing application that includes color information pertaining to a document being edited by the content editing application. At least one color is identified based on at least one of a predefined accessibility standard, predetermined telemetry data, and organizational/group preferences with reference to the color information in the color recommendation request using a color recommendation service. A color recommendation indicating the at least one identified color is provided from the color recommendation service to the content editing application.

Abstract: According to examples, an apparatus may include a processor that may send, to a measurements manager (MM), a first measurement for the processor, cause a hardware and/or a software to send a second measurement to the MM, and cause a virtual machine (VM) to send a third measurement to the MM. The processor may also cause the MM to accumulate the first measurement, the second measurement, and the third measurement and cause the MM to output the accumulated measurements from the MM for attestation of the processor, the hardware and/or the software, the VM, or a combination thereof.

Abstract: Systems and methods relate to executing a task using a machine learning model based on prompt generation and collaborative interactions with a user. The machine language model generating a set of questions based on a task request. The user interactively answers the questions. A task processor generates a set of question-answer pairs based on the questions generated by the machine learning model and the answers given by the user. The machine learning model generates a task specific output based on the set of question-answer pairs. The machine learning model represents a large language model with deep learning. The simple question-and-answer prompts enable non-expert users to instruct the machine learning model with information that is sufficient to execute the task without overwhelming the users with the operations. The machine learning model leverages the answers to execute the task with accuracy, thereby providing efficacy of the prompting technique.

Abstract: Systems and methods for reconfiguring application windows in a display. An example method includes displaying a first application window and a second application window; receiving a drag input for moving the first application window; based on the drag input entering an invocation region, displaying a layout menu with a plurality of display layouts, each of the display layouts including one or more snap zones; receiving a hover of the first application window over a particular snap zone of a particular display layout of the plurality of display layouts; based on the hover of the first application window over the particular snap zone, displaying a zone-indicator pane corresponding to the particular snap zone; receiving a drop input of the first application window over the particular snap zone; and in response to the drop input, resizing and repositioning the first application window according the particular snap zone.

Abstract: In non-limiting examples of the present disclosure, systems, methods and devices for generating pivot tables are provided. A pivot table service may receive an indication to generate a pivot table. The pivot table service may transform a plurality of fields in an existing table in a software application from a first order to a semantic hierarchical order by applying a set of cardinality relationship rules to the plurality of fields. The pivot table service may identify a plurality of blocks comprising one or more fields from the semantic hierarchical order. Fields from each block may be populated and positioned in a pivot table that is being generated based on a cardinality value of each block.

Abstract: Methods, systems, and computer program products for using a confidence measure to automatically identify a diagnostic analyzer that applies to a diagnostic artifact. A plurality of diagnostic analyzers are each configured to analyze diagnostic artifacts relating to prior executions of software entities. A confidence measure is calculated for each diagnostic analyzer. Each confidence measure indicates a likelihood that the diagnostic analyzer applies to a particular diagnostic artifact. Calculating each confidence measure comprises applying one or more heuristics specific to the diagnostic analyzer against the particular diagnostic artifact, with an outcome of application of each heuristic contributing to the confidence measure for the respective diagnostic analyzer.

Abstract: A method and system for intelligently organizing one or more groups of relevant files may include retrieving a user data signal including user-specific data, analyzing the user data signal to identify a parameter relating to file relevance, identifying one or more relevant files in a storage medium based on the parameter at least one of a user category property, a lifecycle stage property, a relevant activity property, or an activity level property of one or more files in the storage medium, organizing the one or more relevant file into the one or more groups of relevant files, and providing for display data relating to the one or more groups of relevant files.

Abstract: A method for proactively providing information to a user about an event involving the user includes receiving user input indicating a request to display a search page and displaying the search page in response to the user input. In addition, event information may be automatically obtained and displayed on the search page in response to the user input. Some examples of event information that may be provided include participant information about a participant in the event other than the user, file information about a file that is relevant to the event, and conversation information about a conversation that is relevant to the event.

Abstract: Example systems described herein are configured to limit inadvertent actuations of a touchpad. The system may include a touchpad, mechanically-activated switch(es), a locking assembly, and a controller. The touchpad is configured to receive a touch input from a user. The mechanically-activated switch(es) are adjacent to the touchpad. The mechanically-activated switch(es) are configured to be activated when a depression force associated with the touch input exceeds a force threshold. The locking assembly is configured to selectively inhibit the touchpad from depressing the mechanically-activated switch(es) depending on whether one or more inhibiting criteria are satisfied. For instance, the inhibiting criteria may take into consideration an inferred intent of the user, an input mode of the touch input, and/or the depression force associated with the touch input.

Abstract: One example provides an integrated computing device, comprising one or more computing clusters, and one or more network controllers, each network controller comprising a local data notification queue to queue send message notifications originating from the computing clusters on the integrated computing device, a remote data notification queue to queue receive message notifications originating from network controllers on remote integrated computing devices, a local no-data notification queue to queue receive message notifications originating from computing clusters on the integrated computing device, and a connection scheduler configured to schedule sending of data from memory on the integrated computing device when a send message notification in the local data notification queue is matched with a receive message notification in the remote data notification queue, and to schedule sending of receive message notifications from the local no-data notification queue.

Abstract: Generally discussed herein are devices, systems, and methods for transparency and control in a user data migration process. A method can include displaying, by a display device, a user interface (UI) including a first display region including text indicating that a legacy application is being replaced by an upgraded application and that a user can select what data from the legacy application is ported over to the upgraded application, receiving, by the UI and from the user, data indicating what portion of data from the legacy application is to be ported over to the upgraded application, and porting over only the portion of the data from the legacy application indicated by the user.

Abstract: Systems and methods for entity recommendation can make use of rich data by allowing the items to be recommended and the recipients of the recommendation (e.g., users) to be modeled as “complex entities” composed of one or more static sub-entities and/or a dynamic component, and by utilizing information about multiple relationships between the sub-entities as reflected in bipartite graphs. Generating recommendations from such information may involve creating vector representations of the sub-entities based on the bipartite graphs (e.g., using graph-based convolutional networks), and combining these vector representations into representations of the items and users (or other recipients) to be fed into a classifier model.

Abstract: Systems and methods for contextual memory capture and recall are provided. The contextual memory capture and recall systems and methods help a user create, store, and recall memory information associated with an identified activity. The contextual memory capture and recall systems and methods are capable of identifying user activities where a memory inquiry may be desirable, creating a memory inquiry with a recommended memory action based on the activity, providing the memory inquiry to the user, and automatically linking an accepted memory action, along with any received memory information for the memory action, with the identified activity.

Abstract: In examples, a requestor device requests data from a data platform. A response from the data platform may include a version identifier indicating a version of data used to process the request and a device identifier indicating the server device that processed the request. Accordingly, the requestor device may include the version identifier and device identifier in a subsequent request, such that the request is routed to the server device accordingly. In examples, the server device may evaluate the version identifier to determine whether the request is associated with a different version of the data, as may occur when the data of the server device has since been updated. Similarly, the requestor device may evaluate a version identifier from the data platform as compared to that of a previously received response to determine whether the response is associated with a different version of data than that of a previous response.

Abstract: Techniques are described herein that are capable of providing a recommendation of an admin change (i.e., an admin change recommendation) in an enterprise. A type of intended admin change that an administrator is to perform with regard to an enterprise is determined. The type is cross-referenced with information indicating admin changes made by administrator(s) in environment(s) of enterprise(s) and values of metrics resulting therefrom to identify subsets of the information to which the type corresponds. A causal relationship is inferred between admin change(s) made after an admin change of the type and an increase in value(s) of metric(s) that are indicated by information in the subsets. A recommended admin change is recommended to be performed by the administrator based at least in part on a causal relationship between the recommended admin change and an increase in at least one of the value(s) of at least one of the respective metric(s).

Abstract: The disclosed techniques optimize the use of computing resources and user engagement by controlling a user interface that displays renderings of meeting participants concurrently with two presentation areas. The participants can include one group of users or multiple groups of users. The two presentation areas are each reserved for content that can be controlled by different users or a single user. In some embodiments, a system can allow users to control the content, e.g., change the content, change a display of a particular page, etc. In some embodiments, individual groups of users can each control specific content in a respective display area. By displaying at least two display areas that each can be independently controlled by one person or multiple people, a system can improve user engagement and improved efficiencies with respect to computing resources.

Abstract: A method may include receiving an indication that a recalculation operation is to be completed for data stored in a data file; determining that a currently assigned number of threads for execution of the recalculation operation is lower than a target number of threads for the recalculation operation; requesting an additional thread for execution of the recalculation operation; beginning execution of the recalculation operation using the currently assigned number of threads; receiving an indication that the additional thread is available for execution of the recalculation operation; updating the currently assigned number of threads to include the additional thread; and continuing execution of the recalculation operation using the updated currently assigned number of threads.

Abstract: Embodiments of the present disclosure include systems and methods for providing hierarchical and shared exponent floating point data types. First and second shared exponent values are determined based on exponent values of a plurality of floating point values. A third shared exponent value is determined based the first shared exponent value and the second shared exponent value. First and second difference values are determined based on the first shared exponent value, the second shared exponent value, and the third shared exponent value. Sign values and mantissa values are determined for the plurality of floating point values. The sign value and the mantissa value for each floating point value in the plurality of floating point values, the third shared exponent value, the first difference value, and the second difference value are stored in a data structure for a shared exponent floating point data type.

Abstract: The present disclosure relates to systems, methods, and computer-readable media for deploying cloud-native services across a plurality of cloud-computing platforms. For example, systems disclosed herein identify resource identifiers associated with cloud-computing services (e.g., types of services) to be deployed on one or more resources capable of executing or otherwise providing cloud-native services. The systems disclosed herein further generate resource bindings including deployment specifications that include data for deploying cloud-native services on corresponding platform resources (e.g., cloud resources, edge resources). Using the resource bindings, the systems disclosed herein can deploy cloud-native services across multiple platforms via control planes configured to manage operation of resources on the different platforms.

Abstract: A transform-by-pattern (TBP) system is configured to proactively suggest relevant TBP programs based on inputted source dataset and target dataset without requiring users typing in examples. The TBP system has access to multiple TBP programs, each of which includes a combination of a source pattern, a target pattern, and a transformation program that is configured to transform data that fits into the target pattern into data that fits into the source pattern. When a source dataset and a target dataset are received from a user, the TBP system identifies a subset of the source dataset and a subset of the target dataset as related data. The TBP system then identifies one or more applicable TBP programs amongst the multiple TBP programs, and suggest or apply at least one of the one or more applicable TBP programs.

Abstract: Methods, systems, and computer program products are provided that automatically scale an application between private and public cloud computing platforms, while simultaneous enforcing policies ensuring private data is persistently stored on the private cloud computing platform, but not the public cloud computing platform. A traffic manager on the public platform routes traffic to instances of a web app executing on a private platform. A traffic monitor on the private platform monitors performance criteria of the private platform, and reports traffic telemetry to the traffic manager. Based on the traffic telemetry, the traffic manager may instantiate one or more instances of the web app on the public platform to handle traffic. Private data gathered by such instantiated instance(s) is persisted to storage in the private platform, but not in the public platform.

Abstract: A communal computing device, such as an interactive digital whiteboard, can become unlocked if a user is near the device. The communal computing device may use a sensor such as a camera to capture images of a person and obtain an identifier from a personal device such as a smartphone. A cloud-based provider that is trusted by both the communal computing device and the personal device may associate both the image and the identifier of the personal device with the same user identity. Obtaining the user identity from multiple, different sources provides a secure technique for the communal computing device to recognize a user without the user directly interacting with the communal computing device. If the sensor no longer detects the user or the personal device is no longer detected, then the communal computing device may log off the user. The personal device may be used to confirm log off.

Abstract: An apparatus and method for synchronizing a triggered system to a triggering system by tracking the timing of rising and falling edges of a clock signal at the triggered system and using the tracked timing values for phase shift adjustment of a time base at the triggered systems.

Abstract: A system provides a notification associated with joining a communication session based on trigger events that occur at a time other than a scheduled start time for the communication session. For example, the notification informs a user who organizes the communication session of a predefined join event that occurs when another user joins the communication session. The predefined join event may occur at a time that is different than a scheduled start time (e.g., before the scheduled start time). Moreover, the notification can include an embedded control that, when activated by the organizing user, causes a device of the organizing user to transmit a join request to join the device to the communication session.

Abstract: Personalized information from venues of interest to a user is provided to the user. The information may comprise messages, notifications, or other information determined to be relevant to the user, and may be timely provided to the user in an appropriate format such that the user is better able to respond to the information. A set of venues that are relevant to the user and corresponding information sources associated with the venue are determined. Information published by these sources may be analyzed for relevance to the user, and the relevant information items may be provided to the user via notifications or applications and services. Further, the notifications may be scheduled for presentation to the user at appropriate times, such as prior to a predicted visit of the venue. One embodiment includes a venue-information clearinghouse for receiving information from venues and making it available for user applications or services.

Abstract: A set of high level test logic is configured to include a set of insertion points. The high-level test logic can be controlled to insert test conditions into a data center configuration. It can also be configured to execute remediation actions that are to be taken, and validation actions to be performed in order to determine whether the remediation action works against the test conditions. Different instances of the high-level test logic can be configured for different environments and different test conditions.

Abstract: A non-fungible physical fabric token (NFPFT) system includes a piece of smart fabric coupled to a physical item. The piece of smart fabric includes a grid of cells configured to receive and persistently store one or more datasets. The NFPFT system also includes a verification and authentication device configured to receive a first dataset associated with the physical item and a second dataset associated with a non-fungible token (NFT) recorded in a decentralized system. The NFT is associated with the physical item. The verification and authentication device is further configured to cause the first dataset and the second dataset to be persistently stored in the grid of cells of the smart fabric.

Abstract: Systems and methods are provided that enable a general framework for partitioning application-defined jobs in a scalable environment. The general framework decouples partitioning of a job from the other aspects of the job. As a result, the effort required to define the application-defined job is reduced or minimized, as the user is not required to provide a partitioning algorithm. The general framework also facilitates management of masters and servers performing computations within the distributed environment.

Abstract: Embodiments of the present disclosure include systems and methods for reducing hardware resource utilization by residual neural networks. In some embodiments, a first matrix is received at a layer included in a neural network. The first matrix is compressed to produce a second matrix. The second matrix has a reduced dimensionality relative to a dimensionality of the first matrix. The second matrix is processed through a network block in the layer included in the neural network. The processed second matrix is expanded to produce a third matrix. The third matrix has a dimensionality that is equal to a dimensionality of the first matrix. The third matrix is added to the first matrix to produce a fourth matrix.

Abstract: Data from data sources may be processed at an edge device. The edge device may generate a local processing result, filter the data, and/or prioritize the data. Accordingly, data is transmitted from the edge device to the data platform, where it may be processed further. For example, a local processing result may be processed at the data platform, such that processing is performed without all of the data source data. In examples, at least a part of such data may remain at an edge device. The edge device may maintain a manifest of data stored by the edge device. The data platform may generate an aggregated manifest using manifests from associated edge devices, such that it may be determined where data is stored. As a result, the data platform may redirect requests to an associated edge device when it is determined that requested data is remote from the data platform.

Abstract: The techniques disclosed herein enable systems to centralize access to various digital items irrespective of the location of those digital items. To achieve this, items that are stored at their original location, e.g., within a cloud storage platform, can be selected by a user for storage at a centralized location such as a favorites section. These items are selected using an interface control which can be an operating system component of an item keeping system that is accessible in any context or application. The item keeping system can generate an item alias for selected items which is then stored in the centralized location. In addition, item aliases can be moved to various destinations by the user to enable customized item storage for items of varying types, origin, and location. In addition, functionality of the interface control can be modified to suite selected items.

Abstract: Embodiments detect cyberattack campaigns against multiple cloud tenants by analyzing activity data to find sharing anomalies. Data that appears benign in a single tenant's activities may indicate an attack when the same or similar data is also found for additional tenants. Attack detection may depend on activity time frames, on how similar certain activities of different tenants are to one another, on how unusual it is for different tenants to share an activity, and on other factors. Sharing anomaly analysis may utilize hypergeometric probabilities or other statistical measures. Detection avoidance attempts using entity randomization are revealed and thwarted. Authorized vendors may be recognized, mooting anomalousness. Although data from multiple tenants is analyzed together for sharing anomalies while monitoring for attacks, tenant confidentiality and privacy are respected through technical and legal mechanisms. Mitigation is performed in response to an attack indication.

Abstract: Methods of secure resource authorization for external identities using remote principal objects are performed by systems and devices. An external entity creates a user group and defines entitlements to an owning entity's secure resource as a set of permissions for the group. An immutable access template with the permissions and an access policy for the secure resource are provided to the owning entity for approval. On approval, a remote principal object is created in the owner directory according to the permissions and access policy. A remote principal that is a group member requests access via an interface to the owner domain using external domain credentials. The identity of the remote principal is verified against the remote principal object by a token service. Verification causes generation and issuance of a token, with the enumerated entitlements, to the remote principal interface affecting a redirect for access to the secure resource.