Abstract: A method allowing the gradual deployment of a new security policy on a data processing system wherein users may access certain objects under the former authorization until complete security implementation is achieved. A user having a security profile satisfying the former security policy criteria, but not the new security criteria, would normally be denied access to objects that were formerly accessible. With the present invention, an intermediate security profile is created while the new policy is being implemented wherein such a user's access is not granted, but not necessarily denied. This tertiary state is achieved by supplementing the security profile of the user to satisfy the new security criteria. When a user attempts object access providing an identity token valid under the former system, arbitration occurs which may result in the synthesis or substitution of a proxy identity which is compliant with the new policy.