Abstract: A system and a method of managing public-key client certificates by at least one processor, including: storing a compliance policy, including one or more rules; continuously monitoring one or more compliance parameters associated with at least one client computer; receiving a certificate request from the at least one client computer to access a computational resource; if the monitored compliance parameters do not comply with at least one rule of the compliance policy, then responding to the certificate request by refusing to grant a certificate to the at least one client computer; and if the monitored compliance parameters comply with the rules of the compliance policy, then responding to the certificate request by granting a policy-based certificate to the at least one client computer.

Abstract: A policy enforcement system may have a mechanism for assisting a user in obtaining an exception to a given policy. The mechanism may collect information from the user as to why the exception is requested, then manage the exception throughout a security system. An exception policy may define the conditions when a user may be granted an exception automatically, as well as when the exception may be granted only through an approval process. An exception created by the mechanism may be logged in an audit file so that each exception is documented. Different exceptions may be defined for different conditions and each exception may have one or more paths by which the exception may be granted. The policy enforcement system may be used for any type of access control to any resource, including URL resources, physical peripherals or networks, data or applications, or any other resource.