Abstract: In selectively enforcing network security policy using group identifiers, access controls are stored in a policy enforcement point (PEP) that controls access to a network. Each access control specifies that a named group is allowed access to a resource. A binding of a network address to an authenticated user, for which the PEP controls access to the network, is stored. The group is updated to include the network address of the authenticated user at the PEP. Packet flows originating from the address can pass from the PEP into the network only if the network address is in the named group identified in one of the access controls that specifies that the named group is allowed access to the network. Thus, network security can be implemented using abstract groups that include specific network addresses; user network access is controlled by updating the groups to modify network addresses of users.